Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the trojanized uxtheme.dll (Cavern Agent) dropped to a non-standard path and side-loaded via WinDirStat.exe
Detects the presence of HijackLoader/IDAT Loader payloads disguised as non-PNG files. The rule identifies files containing concatenated PNG IDAT chunks that do not start with a valid PNG magic header, followed by a canonical IEND terminator, characteristic of steganographic data storage used to deploy the HijackLoader toolkit.
Detects the creation or modification of a file named 'log.txt' within a 'ProgramData' directory by the 'FortiEndpoint_Patch.exe' process. This pattern may indicate the diagnostic logging activity of the FortiEndpoint patch mechanism.
Detects the execution of ADExplorer.exe with the command-line arguments to perform a snapshot export. AD Explorer is a legitimate administrative tool often abused by adversaries to perform offline NTDS.dit extraction or to enumerate Active Directory objects.
Detects instances where known post-exploitation tools or techniques (AD Explorer snapshots, staging of screen captures in public directories, or credential stealer execution) are followed by successful outbound network connections from the same device within a 30-minute window. This behavior often correlates with the collection and subsequent exfiltration of sensitive information.
Detects the execution of a malicious MSI installer masquerading as a legitimate Microsoft FIXMAPI utility. The rule flags suspicious MSI command lines or the presence of the AICustAct.dll component (associated with Advanced Installer) within paths containing the misspelled publisher 'Microsoft Coporation' or the 'Microsoft FIXMAPI' utility string.
Detects the creation of temporary files in the root directory (C:\) following the naming convention 'temp_*.tmp'. This pattern is associated with the evasion or decoy-generation behavior observed in Liushen ransomware, used to check for environmental artifacts or test file system operations.
Detects the creation of specific file artifacts associated with VILE ransomware in the Windows local temporary directory, indicating potential post-infection activity such as ransom note preparation or file staging.
Detects file activity (creation, modification, copying, or renaming) within the 'leveldb' directories of popular web browsers (Chrome, Edge, Brave, Opera) and Discord applications by processes other than the legitimate application executables. This behavior is highly indicative of credential theft or data staging, often associated with malware attempting to extract browser session cookies, local storage databases, or stored credentials.
This rule detects persistence mechanisms established by either modifying common Windows 'Run' registry keys or by placing executable files within user Startup folders. These techniques are commonly used by malware and adversaries to ensure their code executes automatically upon user logon.
Detects the creation or modification of a file named '.config' within the path 'Library/Application Support/com.apple.finder.core/'. This behavior is indicative of potential persistence mechanisms, as adversaries often use hidden files within application support directories to maintain foothold or store configurations on macOS.
This rule detects potential malicious process injection originating from web browsers (chrome.exe or msedge.exe) when followed by the creation or access of a hex-named text file in the C:\ProgramData directory within a 5-minute window. This behavior often suggests a staged attack where a browser process is used to inject malicious code, and subsequently reads or interacts with a dropped file used for persistence or command-and-control communication.
Detects browser navigation to sensitive Google account pages (e.g., myaccount.google.com/contactemail) occurring within 10 seconds of a browser extension installation. This pattern is consistent with automated redirects used to trigger Cross-Site Scripting (XS-Leak) vulnerabilities, potentially allowing attackers to exfiltrate sensitive user data or information via malicious extensions before the user can intervene.
Detects the presence and execution of components associated with the 'Exploitarium' toolkit, a collection of exploit harnesses and proofs-of-concept. The rule monitors for process execution of specific filenames, file creation events, persistence via registry-based service installation, and image loads related to the toolkit's binaries.
Detects the EKZ Stealer malware masquerading as a legitimate Fortinet update process (FortiEndpoint_Patch.exe). The rule monitors for the execution of this specific filename or hash, identifies suspicious command-line arguments (list, search, view, label, export) indicating credential theft activities, and alerts on the creation of the binary and subsequent log files within the ProgramData directory.
Detects credential harvesting behavior by non-browser processes attempting to access browser credential storage (Login Data/Local State files) and identifies execution of the masquerading binary 'FortiEndpoint_Patch.exe' and the creation of the 'log.txt' artifact in C:\ProgramData used by the EKZ Stealer.
Detects execution and file activity associated with Sysinternals AD Explorer, a tool often used by adversaries to enumerate Active Directory environments and perform snapshots.
Detects the creation of a specifically named exfiltration file ('edgeLog.txt') followed by an outbound network connection over port 443 originating from the same process storyline. This pattern is indicative of a process staging stolen data to disk and subsequently exfiltrating it over an encrypted channel to an external destination.
This rule detects the creation or modification of core Chrome extension files (manifest.json, background.js, search.html) within the Chrome User Data directory by processes other than standard Chrome executables (chrome.exe, chromium.exe, googleupdate.exe). It also includes a specific alert for a known extension identifier. This activity is often indicative of unauthorized browser extension installation, potentially for persistence, credential theft, or malicious C2 activity.
Detects the process Crisp.exe creating a legacy AT-style scheduled task job file in the C:\Windows\Tasks directory while simultaneously loading mstask.dll. This behavior is indicative of persistence establishment, specifically associated with the Operation Turb00 HijackLoader sideloading chain which utilizes legacy task scheduling to re-execute AlphVector.exe.
Detects the download of JPEG image files to suspicious system directories (e.g., C:\Windows\, C:\ProgramData\) followed by subsequent file read operations by non-image viewer processes, which is indicative of steganographic payload extraction used in campaigns such as Operation DragonReturn/DcRAT.
Page 93 of 217