Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects specific process execution and command-line activity related to NVIDIA GeForce Experience, specifically focusing on scheduled task creation and suspicious file references that may mimic or abuse legitimate update mechanisms.
Detects Terraform processes (init or apply) executed in conjunction with suspicious post-deployment indicators, such as references to '.terraform' folders, execution of automation scripts like 'dlp.sh' or 'dlp-docker.sh', or access to sensitive telemetry data external to typical infrastructure management.
Detects Terraform processes (init or apply) executed in conjunction with suspicious post-deployment indicators, such as references to '.terraform' folders, execution of automation scripts like 'dlp.sh' or 'dlp-docker.sh', or access to sensitive telemetry data external to typical infrastructure management.
Matches known malicious dlp.sh/dlp-docker.sh Terraform module scripts used in Coder registry supply chain attack (common, aider, rstudio-server, windows-rdp, zed variants)
Detects periodic screen capture activity performed by Node.js or Electron-based processes, correlated with subsequent outbound network connections to public IP addresses within a short timeframe. This behavior is indicative of the JSCeal malware's surveillance and exfiltration module, where local reconnaissance via screenshotting is followed by data transmission.
This rule monitors for the execution of Node.js processes involving a file named 'parser.js' and a component or argument referred to as 'ldata'. This behavior is characteristic of specific application workflows, but when observed as a standalone or unusual process, it may indicate unauthorized script execution or the activity of a malicious node-based tool.
This is something I have seen many times during my years working in cybersecurity: users download software with a filename they recognize and trust, but the file behind that name can be something completely different.
Monitoring the filename is not enough. Monitoring the hash is better, but legitimate software changes constantly: new version, new SHA256, another hash to validate and maintain. So I started thinking about how AI agents could help us here — not by deciding what is malicious, but by doing the repetitive work for us.
For this research, I built an AI-maintained baseline of legitimate software and used it from KQL to hunt two different scenarios:
🎯 Known filename + Unknown hash + Untrusted download source
Monitoring the filename is not enough. Monitoring the hash is better, but legitimate software changes constantly: new version, new SHA256, another hash to validate and maintain. So I started thinking about how AI agents could help us here — not by deciding what is malicious, but by doing the repetitive work for us.
For this research, I built an AI-maintained baseline of legitimate software and used it from KQL to hunt two different scenarios:
🎯 Known filename + Unknown hash + Untrusted download source
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
Detects the creation or modification of a specific file ('libvirtlog.so.0') located in '/usr/lib/' which acts as a gating mechanism for the curlRAT malware. The detection correlates this file event with processes commonly associated with system management that are executing with command line arguments indicative of malicious activity (e.g., 'reverse', 'pty').
This rule detects the presence of specific file hashes known to be associated with backdoored software builds, specifically related to recent supply chain compromises affecting South Korean software vendors (e.g., HAProxy builds). It monitors device file events, process initiation, and identity logon events to identify systems that have deployed, executed, or been accessed by these malicious binaries.
This rule monitors for a multi-stage attack pattern involving two potential indicators: first, it identifies phishing emails containing a 'Google Docs' link combined with an attachment named 'API Logic Flaw'. Second, it detects browser activity involving the paste of JavaScript code or suspicious browser clipboard activity, which may indicate an attacker attempting to execute malicious scripts directly in the user's browser context.
Detects the loading or usage of the malicious driver 'DCRCVDrv.sys' associated with the ClearFake crypto stealer campaign, which uses a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique to interact with the device path '\Device\DCRCVDRV_U' to terminate or impair EDR and security tools.
Detects file creation, modification, or renaming in System32 by TieringEngineService.exe or MsMpEng.exe within a short time frame.
TeamViewer_Desktop.exe is create during install
Detects rapid deletion and creation cycles of the WD_SCAN object manager link, a behavioral pattern associated with a Time-of-Check-to-Time-of-Use (TOCTOU) exploit chain targeting Windows Defender (referenced as CVE-2026-69414). The rule monitors for at least three cycle events occurring within a 5-second window, specifically involving the 'WD_SCAN' object identifier.
Detects Run key persistence pointing to the known VBScript staging directory (C:\Users\Public\Libraries\Default\Lib\Lib1) used by the worm-like ScreenConnect campaign (Aug 2026), matching known script filenames (WindowsServiceHost.vbs, 1.vbs-4.vbs) invoked via wscript.exe/cscript.exe.
Detects Run key persistence pointing to the known VBScript staging directory (C:\Users\Public\Libraries\Default\Lib\Lib1) used by the worm-like ScreenConnect campaign (Aug 2026), matching known script filenames (WindowsServiceHost.vbs, 1.vbs-4.vbs) invoked via wscript.exe/cscript.exe.
This rule detects the presence of specific file artifacts and directory paths associated with the 'Mini Shai-Hulud' malicious campaign, which involves the compromise of the 'openapi-react-query-codegen' npm package. It monitors for indicators of compromise (IOCs) such as specific malicious JavaScript and shell script filenames, as well as persistence artifacts like plist and service files.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects the presence of the 'X_TRACE_' marker within Magento report files or system logs, which is characteristic of the StyleSmuggler threat actor's method of poisoning log files to facilitate subsequent code execution.
Detects the presence of the 'X_TRACE_' marker within Magento report files or system logs, which is characteristic of the StyleSmuggler threat actor's method of poisoning log files to facilitate subsequent code execution.
Page 55 of 139