Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects suspicious use of QEMU virtualization software within an environment, specifically when associated with ConnectWise ScreenConnect. This includes the creation of custom QEMU image files within the ScreenConnect Files directory, the execution of the QEMU binary using those images, the extraction of QEMU archives using 7-Zip, or instances where ScreenConnect processes spawn the QEMU binary directly. This pattern is indicative of unauthorized use of virtual machines to facilitate persistence, lateral movement, or tool staging.
This rule correlates the creation of a new .sys file (excluding standard Windows driver directories) with the subsequent execution of sc.exe to register a kernel service. This behavior is indicative of an attacker attempting to load a malicious driver, often for persistence or rootkit capabilities, using a potentially non-standard path.
Detects the creation of .exe.config files by potentially unauthorized or suspicious processes. Attackers may use these configuration files to hijack the .NET AppDomainManager, enabling malicious code execution when the associated executable is launched. The rule monitors file creation events (Sysmon Event ID 11) and filters out expected installers or update processes while flagging suspicious writing processes like PowerShell, CMD, or non-standard binaries.
Detects anomalous SSH daemon (sshd) activity characterized by the installation or execution of a non-standard sshd binary (often located in /tmp or /var/tmp) or the execution of sshd with suspicious command-line arguments (custom ports or custom configuration files), followed by modifications to the authorized_keys file. This behavior is indicative of unauthorized persistence or backdoor access.
Detects the creation of large archive files (.zip, .7z, .rar, .tar) exceeding 100MB within sensitive or high-risk directory paths such as Desktop, Temp, or AppData, or on non-system drives. This behavior is often associated with the staging of sensitive data for exfiltration.
Detects file creation, modification, or renaming events affecting the 'config.db' file within the Microsoft Desktop App Installer package directory. This file is used by the AppInstaller process and unauthorized modification may indicate attempts to tamper with installed applications or app installation settings.
Detects instances where WinRAR.exe is observed writing potentially malicious script or link files (.hta, .vbs, .js, .ps1, .lnk) into the Windows Startup folder. This pattern is indicative of exploitation of CVE-2025-8088, a path traversal vulnerability in WinRAR often leveraged by the Gamaredon group to establish persistence.
Detects evidence of successful cache poisoning exploitation in Next.js applications by identifying specific marker files ('VULNERABILITY_CONFIRMED.marker' and 'evidence.json') created in conjunction with active 'next start' or 'next build' processes. This pattern aligns with Proof of Concept (PoC) code targeting object argument collisions.
This rule detects when a single process account creates 5 or more files containing 'database', 'db', or '.sql' in their filenames within a one-hour window. This could indicate an attempt to stage, exfiltrate, or manipulate database files.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with the '-o' flag to output to a .zip file from an HTTP/HTTPS URL, and then correlates this with a file creation event for a .zip file on the same device.
Detects the creation of web-executable files (e.g., .aspx, .ashx, .php, .jsp, .asmx) within sensitive web root directories (IIS, Exchange, SharePoint) when the writing process is identified as an IIS worker process (w3wp.exe) or an Exchange Unified Messaging worker process (UMWorkerProcess.exe). This activity is highly indicative of web shell deployment for post-exploitation persistence, commonly associated with vulnerabilities like CVE-2021-26855 or CVE-2022-41082.
This rule detects potential ransomware activity by identifying processes that perform a high volume of file write, create, or rename operations across a large number of unique file paths within a short timeframe. It also includes a heuristic check for filenames containing 'inc' or 'lynx', often associated with specific ransomware variants.
Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.
Detects Remcos RAT installation activity characterized by file creation under C:\ProgramData\Remcos\ followed by the use of Windows system utilities like attrib.exe or icacls.exe to apply system, hidden, or restricted attributes to the directory or executable, effectively concealing the malware from the user.
This rule detects techniques commonly used by attackers to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. It monitors for the execution of known Mimikatz binaries or the use of specific Mimikatz command-line arguments, the execution of legitimate tools like Procdump to dump LSASS memory, the misuse of rundll32 with comsvcs.dll to perform a memory dump, and the creation of files named lsass.dmp, which are common artifacts of credential dumping activities.
Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.
Detects artifacts and activity related to the exploitation of CVE-2026-55200 in libssh2. The rule monitors for the creation or execution of identified libpwn exploit harness files and scripts, as well as suspicious network activity involving TCP port 2222, which is the default port for the PoC rogue SSH server. It also correlates the appearance of these exploit files with subsequent outbound SSH connections.
This rule detects the creation of executable script files (.aspx, .php) within the webroot images directory or identifies known specific filenames associated with web shells. This behavior is indicative of an adversary attempting to establish a web shell for persistent access or command execution on a web server.
Detects attempts to perform container escapes by abusing the 'docker cp' command. The rule identifies path traversal sequences in 'docker cp' arguments, as well as unauthorized shell or script execution spawned by container daemon processes (e.g., dockerd, containerd) following a file copy operation, and specific file creation patterns indicative of a container escape attempt.
This rule detects the installation of a new Microsoft Edge extension followed by suspicious network activity from the msedge.exe process within 24 hours. The suspicious activity includes the fetching of common steganography-friendly file types (e.g., .png, .webp, .woff2, .conf) from known StegoAd C2 domains. This behavior is indicative of a malicious extension retrieving payloads hidden in legitimate-looking media files or beaconing to attacker infrastructure.
Detects file creation or write access to C:\Windows\System32\sethc.exe or sethc.exe.bak, indicating a sticky keys backdoor technique where an attacker replaces the Sticky Keys binary with cmd.exe or another shell to obtain a SYSTEM-level shell at the login screen.
Page 99 of 217