Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,877
5,156
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects a discrepancy between the SHA256 hash of a running process image (via /proc/<pid>/exe on Linux) and the hash of the corresponding binary file on disk. This behavior is indicative of process memory manipulation, such as fileless execution or binary replacement, where the code currently running in memory does not match the original file on disk.
This rule detects the concurrent existence of specific process names (calibre-launcher.dll or wint.exe) and a specific file (SysPr.prx) on a device, combined with network connections to a specific Cloudflare R2 bucket. This pattern is indicative of potential malware activity involving suspicious DLLs, file drop-offs, and communication with remote infrastructure.
Detects the PoisonedRefresh implant's UNIX domain socket backdoor by (1) file activity on the uniquely-named /run/bigtlog.pipe socket initiated by an Apache/httpd process, and (2) process command lines containing the implant's hardcoded authentication token. Removed the earlier generic 'bash spawned by httpd' heuristic, which fired on legitimate CGI/mod_php/admin automation that shells out from the web server and was the dominant false-positive source.
Detects the PoisonedRefresh implant's UNIX domain socket backdoor by (1) file activity on the uniquely-named /run/bigtlog.pipe socket initiated by an Apache/httpd process, and (2) process command lines containing the implant's hardcoded authentication token. Removed the earlier generic 'bash spawned by httpd' heuristic, which fired on legitimate CGI/mod_php/admin automation that shells out from the web server and was the dominant false-positive source.
Detects potential DLL side-loading attempts involving GlobalProtect VPN components. The rule identifies the execution of GlobalProtect.exe with specific command-line arguments combined with the presence of suspicious versions of bcrypt.dll or WININET.dll within the same directory, which are characteristic of recent malicious activity involving modified DLL files targeting GlobalProtect environments.
This rule monitors security event logs for the presence of a specific file hash identified as potentially malicious (d41d8cd98f00b204e9800998ecf8427e). This hash specifically corresponds to an empty file (MD5 checksum of an empty string), often indicating potential obfuscation techniques, failed file writes, or placeholder files used by malicious scripts.
This rule monitors security event logs for the presence of a specific file hash identified as potentially malicious (d41d8cd98f00b204e9800998ecf8427e). This hash specifically corresponds to an empty file (MD5 checksum of an empty string), often indicating potential obfuscation techniques, failed file writes, or placeholder files used by malicious scripts.
Detects the execution or presence of files, processes, or paths associated with the 'SnowKiller' malware or tool, as identified by keyword matching in process event logs.
This rule detects the installation of browser extensions that occur during an idle user session (greater than 7 minutes). This behavior is consistent with automated, remote-driven synthetic input injection, often utilized by malware (e.g., NinjaMare) to install malicious extensions without user consent while the system is unattended.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects potential web shell activity by identifying suspicious PHP file creation within Magento-style product cache directories and the execution of find commands targeted at searching for PHP files in the web directory. This behavior is indicative of an attacker attempting to plant a web shell and subsequently enumerating web files for further exploitation.
This rule detects the presence of specific file hashes known to be associated with backdoored software builds, specifically related to recent supply chain compromises affecting South Korean software vendors (e.g., HAProxy builds). It monitors device file events, process initiation, and identity logon events to identify systems that have deployed, executed, or been accessed by these malicious binaries.
Detects files referencing malicious implant install paths under C:\Windows\Fonts\web used to blend with legitimate system files
Detects PEEP Secure Preferences integrity-hash forgery (protection.macs/super_mac) and known PEEP persistence scripts (patch_secure_prefs.ps1, install_silent.ps1, force_enable.ps1), anchored to actual Chrome/Edge profile paths rather than generic terms like 'protection' or 'developer_mode' that appear in unrelated admin tooling.
Detects PEEP Secure Preferences integrity-hash forgery (protection.macs/super_mac) and known PEEP persistence scripts (patch_secure_prefs.ps1, install_silent.ps1, force_enable.ps1), anchored to actual Chrome/Edge profile paths rather than generic terms like 'protection' or 'developer_mode' that appear in unrelated admin tooling.
Detects the execution or presence of files, processes, or paths associated with the 'SnowKiller' malware or tool, as identified by keyword matching in process event logs.
This rule monitors for indicators of compromise (IOCs) and behavioral patterns associated with the Lazarus Group's 'Operation Dream Job' campaign. It tracks known malicious hashes, domains, and IP addresses, alongside suspicious activities such as PDF viewer abuse, DLL side-loading, process injection, persistence mechanism creation (Registry/Scheduled Tasks), and recruitment-themed phishing lures.
Detects a discrepancy between the SHA256 hash of a running process image (via /proc/<pid>/exe on Linux) and the hash of the corresponding binary file on disk. This behavior is indicative of process memory manipulation, such as fileless execution or binary replacement, where the code currently running in memory does not match the original file on disk.
Detects the PoisonedRefresh implant's UNIX domain socket backdoor by (1) file activity on the uniquely-named /run/bigtlog.pipe socket initiated by an Apache/httpd process, and (2) process command lines containing the implant's hardcoded authentication token. Removed the earlier generic 'bash spawned by httpd' heuristic, which fired on legitimate CGI/mod_php/admin automation that shells out from the web server and was the dominant false-positive source.
Page 51 of 139