Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects a suspicious sequence where 7-Zip is used to extract a RAR archive, immediately followed by the creation of executable files (.exe, .bat, .cmd, etc.) in common user-writable directories. This chain often indicates an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted by archive tools may not inherit the MotW zone information, allowing potentially malicious files to execute without security prompts.
This rule detects potential container escape attempts by monitoring for malicious use of the 'docker cp' command with path traversal sequences (../) or the creation of suspicious files by the docker daemon outside of expected docker storage directories, which may indicate symlink injection attacks to modify files on the host filesystem.
This rule monitors Cisco SD-WAN environments for indicators of post-exploitation, including unauthorized SSH lateral movement, abuse of administrative tools (vshell, confd_cli), suspicious tenant list modifications related to CVE-2026-20245, privilege escalation to backdoor accounts, system file tampering (/etc/passwd, /etc/shadow), and anti-forensic activities such as log and history deletion.
This rule detects the creation of executable files within specific directories in the user's AppData Roaming profile, specifically matching patterns associated with known persistence or malicious staging filenames (xwreg or xgdf). This location is frequently abused by attackers to store persistent payloads that execute outside of standard program directories.
Campaign converting compromised FortiGate firewalls into credential stealers
This rule detects 'git clone' operations on Windows systems that are correlated with the creation of or access to specific Amazon Q or VSCode Model Context Protocol (MCP) configuration files ('mcp.json'). The rule identifies potential unauthorized project cloning or reconnaissance activity involving developer tools.
Detects a suspicious sequence of events involving the creation of an .amazonq/mcp.json file shortly after a git clone operation, followed by an AI coding assistant (Amazon Q, VS Code, Cursor, Windsurf) spawning runtime interpreters (node, npx, python). This behavior aligns with potential exploitation attempts against AI-assisted development environments, such as CVE-2026-12957, where malicious configuration files are used to trigger unauthorized code execution.
Detects the creation of .amazonq/mcp.json or mcp.json files within repository directories following a git clone operation. This behavior is associated with the exploitation of vulnerabilities (such as CVE-2026-12957) where attackers use malicious job-interview repositories to trigger automatic execution of arbitrary MCP (Model Context Protocol) servers in the Amazon Q Developer extension in VS Code, potentially leading to unauthorized credential or sensitive data access.
This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.
Detects the execution of Node.js-based JavaScript payloads (notably 'jquery.js') delivered via Remote Monitoring and Management (RMM) sessions, specifically SimpleHelp. The rule monitors for file creation of the payload in sensitive locations, the execution of the payload by Node.js, and subsequent post-exploitation discovery commands executed by the Node.js process.
Detects a potential exploitation of CVE-2026-12957, where a malicious git repository contains an MCP (Model Context Protocol) configuration file. When this workspace is opened, the Amazon Q Developer extension for VS Code improperly processes this configuration, resulting in the unauthorized execution of shell processes (cmd.exe, powershell.exe, bash, or sh) by the extension's host processes (code.exe or node.exe).
Detects WinRAR.exe writing files to sensitive directories such as the Startup folder or C:\ProgramData, potentially indicative of exploitation of path traversal vulnerabilities (CVE-2025-8088, CVE-2025-6218). This activity is associated with UAC-0226's use of WinRAR to establish persistence or stage malicious payloads.
Detects WinRAR application writing a shortcut (.lnk) file directly into the Windows Startup folder. This activity is indicative of exploitation of NTFS Alternate Data Stream (ADS) path traversal vulnerabilities (such as CVE-2025-8088 or CVE-2025-6218) to achieve persistence by placing a malicious shortcut in the user's startup directory without triggering typical user interaction warnings.
Detects artifacts, execution of harness tooling, and post-exploitation behavior associated with CVE-2026-55200 in libssh2. The rule monitors for the presence of known exploit filenames (libpwn), suspicious Python script execution, unexpected shell spawning from SSH-enabled clients, and outbound network connections to non-standard ports typical of exploit scaffolding.
Detects the drop or installation of known vulnerable drivers associated with the 'The Gentlemen' ransomware group's Bring Your Own Vulnerable Driver (BYOVD) tactics, or the creation of kernel-mode services by unsigned binaries. These techniques are often used to gain kernel-level privileges and disable security software.
This rule detects the creation of new executable files in suspicious locations, specifically targeting potential masquerading or evasion attempts in Windows Error Reporting (WER) paths (using randomly named folders) and generic Windows Temp directories by non-system accounts (excluding Microsoft Defender's engine process).
This rule detects the modification or creation of sensitive Linux files often used for persistence, such as cron job configurations, system boot scripts, and custom system tools. It monitors for file writing and process execution events involving specific paths and filenames identified as associated with persistence mechanisms or monitoring tools.
This rule detects potential persistence via Windows Registry Run keys by monitoring for the creation or modification of values pointing to suspicious paths (e.g., AppData, Temp, winupdate.exe). It also identifies suspicious execution of files originating from user-writable directories, specifically looking for indicators of PyInstaller-packaged executables or specific known malicious hashes, which are frequently used by adversaries for malware deployment.
This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.
Detects the creation or modification of common log file types (e.g., .log, .txt, .dat, .kl) by unsigned, non-standard processes executing from high-risk directories like AppData, Temp, or ProgramData. This behavior is indicative of potential keylogging activities associated with remote access trojans (RATs) such as Atlas RAT or ValleyRAT.
Detects the execution or loading of executables (.exe) or dynamic link libraries (.dll) located in user-specific temporary or roaming directories (AppData). These directories are common locations for attackers to drop payloads, execute malicious code, or achieve persistence, as they are writable by standard users without elevated privileges. The rule includes filters for known legitimate processes that may perform operations in these directories to reduce noise.
Page 98 of 217