Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the use of 7-Zip (7z.exe) to extract a file named drata.dat using command line arguments that indicate silent extraction from an encrypted or password-protected archive. This behavior is associated with the LegionLoader malware, which uses this technique to stage its payload.
Detects the installation of a specific malicious Firefox browser extension identified by its unique internal ID 'pdf-para-texto@extensao.local' or by its name 'PDF Identity Verifier'. This behavior is characteristic of adversaries using browser extensions for persistence or credential theft.
Detects the creation of a malicious GitHub Actions workflow file named 'runtime-update.yml', a known tactic used by the Sckit supply-chain worm. The worm injects this workflow to automate persistence and further propagation of the Go-based implant within CI/CD pipelines.
Detects instances where a process that is not a recognized web browser accesses or enumerates the file storage path of the MetaMask browser extension. This behavior is indicative of unauthorized reconnaissance or credential theft attempt targeting cryptocurrency wallet data stored locally, often performed by malware following successful system compromise.
Detects legitimate, signed executables from trusted system locations (e.g., System32) loading DLLs from non-standard, user-writable directories (e.g., Temp, AppData). This activity is a classic indicator of DLL side-loading, where an adversary places a malicious DLL in a directory to be picked up by a legitimate application, enabling the execution of malicious code under the context of a trusted process.
Detects the Sckit Go implant accessing sensitive local configuration and credential files, including SSH keys, cloud CLI tokens, and package manager credentials. The rule monitors for file read events initiated by processes identified as 'sckit' or processes with specific command line arguments.
This rule detects access (creation, modification, renaming, or reading) to browser-specific sensitive credential files ('Login Data' or 'Local State') located in the user data directories of Chrome, Edge, or Brave. It filters out legitimate activity by ensuring the initiating process is not the browser's own application executable, which is indicative of credential theft or dumping by unauthorized tools.
Detects unauthorized processes attempting to read or modify Discord's local storage leveldb files, which store user authentication tokens, and correlates this with suspicious network activity to Discord's API or the presence of token-stealing keywords in command-line arguments.
This rule detects rundll32.exe executing a DLL from the ProgramData directory and subsequently establishing five or more outbound network connections to external IP addresses over non-standard ports (excluding 80 and 443) within a one-hour window. This behavior is indicative of a potential malware beaconing or data staging activity using a proxy binary to evade detection.
Detects the unauthorized creation of script or executable files in the Windows Startup directory by .NET or Python runtime processes, specifically targeting the exploitation pattern of CVE-2026-25592. This vulnerability allows an AI agent host to bypass sandbox isolation and write files to the host filesystem, potentially establishing persistence.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
Detects the presence or execution of known malicious Remote Monitoring and Management (RMM) tool binaries associated with phishing campaigns, such as those impersonating MSP360 or ScreenConnect.
Detects the execution of MSP360 or generic RMM-labeled binaries originating from common user download directories (Downloads or Temp folders) when the filename mimics common phishing lures such as invoice, e-card, RSVP, or document-related naming conventions. This activity indicates a potential social engineering attempt to execute remote monitoring and management tools.
Detects the presence or execution of known malicious Remote Monitoring and Management (RMM) tool binaries associated with phishing campaigns, such as those impersonating MSP360 or ScreenConnect.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
This rule performs a sweep across device file and process events to identify the execution or presence of files matching a curated list of 161 SHA256 hashes associated with twelve known malicious threat actors and families (Lynx, ANUBIS, Rhysida, LockBit, ALPHV/BlackCat, Qilin, Medusa, The Gentlemen, NetRunner, Genesis, Pay2Key, and Handala). The rule filters out events occurring in known EDR/AV quarantine or sandbox directory structures and dedupes hits on a per-device and per-hash basis within 24-hour windows to reduce alert noise.
This rule performs a sweep across device file and process events to identify the execution or presence of files matching a curated list of 161 SHA256 hashes associated with twelve known malicious threat actors and families (Lynx, ANUBIS, Rhysida, LockBit, ALPHV/BlackCat, Qilin, Medusa, The Gentlemen, NetRunner, Genesis, Pay2Key, and Handala). The rule filters out events occurring in known EDR/AV quarantine or sandbox directory structures and dedupes hits on a per-device and per-hash basis within 24-hour windows to reduce alert noise.
This rule monitors for the execution of an executable file (.exe) from a user's 'Downloads' directory followed shortly (within 5 minutes) by a network connection to port 4321, which is characteristic of the Bear C2 HTTPS-AES beacon pattern. This behavior is indicative of a potential secondary stage malware execution or C2 check-in after an initial user-driven download.
This rule detects the execution of a file with an .exe extension from the user's Downloads directory that has been previously tagged with the Mark-of-the-Web (MOTW) Zone.Identifier. It correlates file creation events, the application of the MOTW alternate data stream, and subsequent process execution to identify potentially malicious downloaded executables.
This rule monitors for the execution of an executable file (.exe) from a user's 'Downloads' directory followed shortly (within 5 minutes) by a network connection to port 4321, which is characteristic of the Bear C2 HTTPS-AES beacon pattern. This behavior is indicative of a potential secondary stage malware execution or C2 check-in after an initial user-driven download.
Page 14 of 139