Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects activities indicative of the RoguePlanet exploit, which utilizes NTFS junction swapping to stage malicious operations. It monitors for the creation of suspicious system-like directories within temporary paths, writing of executables (like wermgr.exe) to those paths, unprivileged manipulation of the Windows Defender Quarantine directory, and virtual disk image mounting from user-writable directories.
Detects phishing attempts using .ics (calendar) files that originate from the 'groups.outlook.com' domain, often used to deliver meeting invites that contain malicious links or social engineering lures.
This rule detects the presence and execution of files and scripts associated with the exploitation of CVE-2026-55200, such as harness binaries and proof-of-concept scripts. Additionally, it identifies post-exploitation behavior where common network-related processes (like curl, git, or sshd) spawn suspicious or unexpected child processes, which may indicate successful code execution or lateral movement originating from the compromised service.
Detects the post-exploitation behavior associated with EKZ Stealer, specifically the creation of a credential-containing log file in ProgramData, followed by the rapid deletion of the file and the source stealer binary. This behavior is indicative of anti-forensic cleanup steps often used to conceal credential harvesting activities.
Detects high-frequency file write activity combined with the creation of text files, which is a common behavior exhibited by ransomware during the encryption phase of an attack. The rule monitors for a large volume of file creations across a host and specific patterns indicative of ransom note generation.
Detects the creation of specific shortcut files (.lnk) or the use of WScript.Shell and CreateShortcut methods within PowerShell, associated with the VILE ransomware's fake decryptor lure technique.
This rule detects the creation of specific hidden files ('.Maccy', '.lock', '.config') within the 'Library/Application Support/com.apple.finder.core/' directory on macOS. This behavior is indicative of potential persistence mechanisms, configuration tampering, or malicious activity related to the Finder application environment.
This rule detects the execution of the AD Explorer tool followed by the creation of a .dat file within a 10-minute window. AD Explorer is a known administrative tool often used by adversaries for Active Directory reconnaissance, and creating or saving files with a .dat extension may indicate the export of captured AD data for further analysis or exfiltration.
Detects the creation of specific staging directories prefixed with 'RP_' in user temporary directories, containing 'System32' or 'wdtest_temp' subdirectories. This pattern is characteristic of an NTFS junction swap exploitation technique used to target Windows Defender quarantine artifact placement as part of the CVE-2026-50656 vulnerability.
Detects indicators of exploitation attempts against the CVE-2026-55200 libssh2 heap out-of-bounds write vulnerability. The rule identifies the creation of known PoC artifacts on disk, execution of exploit harnesses or probe binaries, Python scripts masquerading as or interacting with the PoC server, and libssh2-dependent client applications making network connections to the non-standard port 2222 used by the exploit scaffold.
Detects the extraction of executable, script, or macro-enabled files from archives using 7-Zip utilities. This behavior is notable because 7-Zip often fails to propagate the Mark-of-the-Web (MotW) Zone.Identifier Alternate Data Stream (ADS) to extracted files, which can bypass Windows SmartScreen and security zone protections upon subsequent execution of the extracted files.
Detects the creation of shortcut (.lnk) files in the Windows Startup directory by common archive extraction utilities, indicative of the Gamaredon/UAC-0226 GIFTEDCROOK campaign using CVE-2025-8088 to perform path traversal and gain persistence.
This rule detects the creation of a new .sys driver file outside of standard Windows system directories (System32/drivers, DriverStore, SysWOW64/drivers) followed by the registration or modification of a service in the Windows Registry (CurrentControlSet/Services) within 15 minutes. This pattern is indicative of potential unauthorized driver installation or a Bring Your Own Vulnerable Driver (BYOVD) attack.
Detects the creation of 'delete.me' files in critical Windows directories (specifically C:\Windows and SYSVOL paths). This behavior is associated with the Akira ransomware, which uses these marker files to coordinate domain-wide encryption tasks, often executed by the System account during the preparation phase of an attack.
Detects the creation or modification of a .vscode/tasks.json file, followed by the execution of a process (specifically node.exe) that targets a script file without a standard JavaScript extension (.js, .mjs, .cjs). This behavior is consistent with an adversary configuring a hidden VS Code task (e.g., using 'hide:true' and 'runOn:folderOpen') to silently execute arbitrary code or assets when a project folder is opened.
Detects the presence, file creation, or execution of known proof-of-concept (PoC) scripts, binaries, and directories associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability.
Detects potentially malicious activity involving MySQL processes, specifically focusing on the creation of files within the /var/lib/mysql-files/ directory, use of SQL 'INTO OUTFILE' for file output, or the use of 'LOAD_FILE()' to read sensitive system files like /etc/hostname or /proc/1/mountinfo, often indicative of SQL injection exploitation or unauthorized data access.
Detects the creation of multiple executable files following a specific naming pattern (RageCore prefix with win_guard suffix) across common staging directories like Temp, Public, and ProgramData. This behavior is indicative of a malicious installer or worm-like component attempting to hide itself or proliferate by placing multiple copies of its payload in common, low-privilege-accessible locations.
Detects browser search traffic being hijacked to the typosquatted domain 'perplexity-ai.online' by the malicious Chromium extension 'Search for perplexity ai'. The rule monitors for network connections to the malicious domain and the presence of extension-related file artifacts on the system. The extension utilizes chrome_settings_overrides to redirect browser Omnibox queries and exfiltrate user search activity to attacker-controlled infrastructure.
Detects a process creating SQLite-style database files with random hex-like names within a randomly named subfolder of the Windows %TEMP% directory. This behavior, when correlated with file system access to specific cryptocurrency wallet directories (Electrum, Exodus, Ethereum, Coinomi), is consistent with Vidar information stealer staging activity.
Detects indicators of a malicious driver or associated activity named 'pcdhost.sys'. The rule monitors for the installation of this driver via 'sc.exe', registry modifications related to this filename, the creation of this file on disk, and specific suspicious process command-line artifacts ('AtLorenBase', 'MANPO: ReadModule', 'PERS: FAIL', 'RUNPE:', 'POST: hollow=') typically associated with malware or offensive toolkits.
Page 94 of 217