Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects the installation and configuration of the OpenSSH Server feature on Windows endpoints. It monitors for the use of Add-WindowsCapability to install the feature, administrative commands (net.exe, sc.exe) used to manage the sshd service, and the creation or modification of authorized_keys files, which are often used to maintain persistent, passwordless access to the system.
Detects the download of potential second-stage malicious payloads disguised as JPEG files to the C:\Windows\ directory using the URLDownloadToFile method. This activity is associated with Operation DragonReturn, where attackers save payloads as background.jpg for later decryption and execution.
Detects the execution of the GS-Netcat network utility with flags characteristic of reverse shells (e.g., -e, -i, -S, -D) in conjunction with the creation of a systemd service unit file on the same host, which is a technique used by the Velvet Ant threat actor for persistence.
Detects unauthorized file write or rename operations targeting core OpenSSH binary and library paths, excluding known package manager activities. This behavior is indicative of an adversary replacing legitimate system binaries to create a trojanized version of OpenSSH, as observed in the Velvet Ant 'Operation Highland' campaign, used to harvest credentials and log SSH sessions.
Detects suspicious file creation activities by system authentication processes (e.g., sshd, su, sudo, PAM) in known staging directories (/tmp, /var/tmp, /dev/shm) or SSH configuration paths. The rule looks for hidden files or files with specific extensions (.log, .dat, .bak) often associated with malicious backdoored components used to intercept and store credentials in plaintext.
Detects the creation of unsigned executable files (.exe or .dll) larger than 50MB on an endpoint. This activity is often associated with the staging of large, unsigned, or potentially malicious binaries, which may indicate the deployment of tools for further malicious activity or masquerading.
Detects execution of OfficeUpdater VBScript via wscript.exe or cscript.exe with specific command line arguments, or the creation of corresponding .ini configuration files. This pattern is indicative of potential malicious activity or persistence mechanisms mimicking legitimate update processes.
Detects attempts to exploit the SystemInformer (formerly Process Hacker) service (phsvc) for local privilege escalation. The rule monitors for abnormal process spawning by rundll32.exe, the presence of specific PoC artifacts like 'phsvc_rundll_poc.dll', 'systeminformer_phsvc_poc.txt', or command-line arguments containing 'SYSTEMINFORMER_PHSVC_POC', and loading of DLLs from user-writable temporary directories.
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
This rule detects file system artifacts and network activity associated with a malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). The extension utilizes service workers to intercept browser search queries and capture keystrokes, subsequently exfiltrating the data to an attacker-controlled domain.
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
Detects the presence of a malicious Electron-based backdoor disguised as the Franz messaging application, commonly associated with the 'ClickFix' campaign. The rule identifies indicators such as a specific C2 endpoint, automated persistence via Electron login item settings, arbitrary JavaScript execution through a 'task.e' sink, and the creation of local persistence files like 'readme.txt' and 'setup.txt'.
Detects disguised malicious files, typically mimicking XML or MAP documents, that contain multiple PNG IDAT chunk markers but lack a valid PNG header and XML declaration. This signature is consistent with the HijackLoader staging technique, where XOR-encrypted and LZNT1-compressed data is hidden within the structure of spoofed file formats.
Detects behavior associated with the SnappyClient remote access trojan, specifically identifying the execution of 'VirtualAr.exe', which performs GDI-based screen capture and keyboard hooking via 'SetWindowsHookEx', followed by the staging of stolen data within the 'ProgramData\Mayanex\Nata' directory.
Detects DLL side-loading activities where the legitimate Radmin VPN executable loads an unsigned or malicious Qt5Core.dll from its local directory, or creates anomalous XML files that function as PNG-IDAT steganography containers. This behavior is associated with HijackLoader (IDAT Loader) malware infection chains.
Detects the creation of files within the Windows startup directory or Windows tasks folder. The rule specifically excludes known system binaries like schtasks.exe and mstask.exe to reduce noise, and attempts to categorize the artifacts based on specific naming patterns.
This rule detects files created where the internal 'FileCreationTime' significantly deviates from the actual observed file-creation time. Specifically, it identifies files created more than 30 days in the past or with a future creation timestamp, which are common indicators of timestomping techniques used to hide malicious files or evade time-based forensic analysis.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.
Detects the creation or modification of a file named 'maisum.dat' on endpoint devices. This filename is often associated with malicious activity, including malware persistence or configuration staging, and warrants investigation to determine the nature of the file and the process that created it.
This rule detects potential phishing activity by monitoring for the creation of specific PDF files matching common financial-themed lures and network connections to a known malicious domain 'facture-in.pages.dev'. It tracks file-based lure indicators on local devices and network requests to identify potential initial access or delivery stages of an attack.
Page 96 of 217