Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the presence of the 'X_TRACE_' marker within Magento report files or system logs, which is characteristic of the StyleSmuggler threat actor's method of poisoning log files to facilitate subsequent code execution.
This rule detects potential malicious activity on macOS where a user or script is prompted to open a legitimate-looking application bundle (decoy) while, in close temporal proximity (within 2 minutes), background processes related to hidden .macos payloads or quarantine flag manipulation via 'xattr' are executed. This is a common pattern for malware to appear legitimate to the user while performing malicious setup or persistence in the background.
This rule detects the installation of browser extensions that occur during an idle user session (greater than 7 minutes). This behavior is consistent with automated, remote-driven synthetic input injection, often utilized by malware (e.g., NinjaMare) to install malicious extensions without user consent while the system is unattended.
This rule performs a comprehensive hunt for activities associated with the MuddyWater (also known as Boggy Serpens) threat group, specifically relating to their 'Operation Olalampo' campaign. It monitors for spearphishing artifacts (lure documents and attachments), execution of specific malware and drop artifacts, the use of LOLBins by Office applications, unauthorized remote access via AnyDesk, Telegram-based C2 communication, and persistence mechanisms such as registry run keys and specific file extensions (.wdlp).
Detects the creation, modification, or renaming of unsigned executable files (.exe, .dll, .sys, .efi) within critical Windows system directories (System32, SysWOW64, drivers, boot). The rule excludes activity triggered by known trusted OS update processes, such as TrustedInstaller or Windows Update services, and optionally flags occurrences outside defined maintenance windows.
Detects the creation, modification, or renaming of unsigned executable files (.exe, .dll, .sys, .efi) within critical Windows system directories (System32, SysWOW64, drivers, boot). The rule excludes activity triggered by known trusted OS update processes, such as TrustedInstaller or Windows Update services, and optionally flags occurrences outside defined maintenance windows.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
This rule monitors security event logs for the presence of a specific file hash identified as potentially malicious (d41d8cd98f00b204e9800998ecf8427e). This hash specifically corresponds to an empty file (MD5 checksum of an empty string), often indicating potential obfuscation techniques, failed file writes, or placeholder files used by malicious scripts.
Detects file system operations targeting common user directories and specific file extensions (.bak, .backup, .locked) often associated with data exfiltration, staging, or ransomware activity.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects potential web shell activity by identifying suspicious PHP file creation within Magento-style product cache directories and the execution of find commands targeted at searching for PHP files in the web directory. This behavior is indicative of an attacker attempting to plant a web shell and subsequently enumerating web files for further exploitation.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
Detects files referencing malicious implant install paths under C:\Windows\Fonts\web used to blend with legitimate system files
This rule detects file-based activity associated with a tool named 'gh-token-monitor', which is likely used for the monitoring or exfiltration of GitHub access tokens from a compromised host. The rule monitors for the creation or presence of specific scripts, configuration files, and directory paths associated with this activity, including files related to a 'claude' configuration.
Detects the creation or modification of a specific file ('libvirtlog.so.0') located in '/usr/lib/' which acts as a gating mechanism for the curlRAT malware. The detection correlates this file event with processes commonly associated with system management that are executing with command line arguments indicative of malicious activity (e.g., 'reverse', 'pty').
This rule detects the presence of specific file hashes known to be associated with backdoored software builds, specifically related to recent supply chain compromises affecting South Korean software vendors (e.g., HAProxy builds). It monitors device file events, process initiation, and identity logon events to identify systems that have deployed, executed, or been accessed by these malicious binaries.
This rule monitors endpoint events (file, process, and image load) for a specific malicious MD5 hash or the presence of a specific file name pattern 'Request for Quotation' often used in malicious lures. It provides visibility into potential execution of known malicious payloads.
This rule monitors endpoint events (file, process, and image load) for a specific malicious MD5 hash or the presence of a specific file name pattern 'Request for Quotation' often used in malicious lures. It provides visibility into potential execution of known malicious payloads.
Detects a sequence of events where a PDF file opened from a Microsoft Outlook content directory triggers an immediate subsequent execution of a Microsoft Edge process pointing to a Google Sites URL, or containing suspicious command line arguments often associated with malicious redirection or web-based credential harvesting.
Detects a sequence of events where a PDF file opened from a Microsoft Outlook content directory triggers an immediate subsequent execution of a Microsoft Edge process pointing to a Google Sites URL, or containing suspicious command line arguments often associated with malicious redirection or web-based credential harvesting.
Page 56 of 139