Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,877
5,156
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
This rule monitors for file-level artifacts related to the ModHeader browser extension, specifically targeting folder paths and file names that match the extension's unique ID. This is typically used to identify the installation or download of this extension, which has been associated with malicious activity.
This rule detects the creation of the 'C:\Config.Msi' folder or files within it that have weak security descriptors (SDDL). This folder is frequently used by the Windows Installer service, and if insecure permissions are applied, an attacker can perform privilege escalation or perform DLL hijacking by placing malicious files within this directory.
Detects Blind Eagle JC-46 VBScript/JScript loader obfuscation toolmarks: zv-prefixed self-mutating XOR decryptor with 0xE0 key, junk arithmetic index shuffle, custom RC4-like stream decoder, custom AES S-box/RCON with 0xA5 mask, Wales() decimal decoder, Base28 alphabet, and oversized VBScript droppers
This rule detects file-level activity associated with the known malicious version of the ModHeader browser extension (Extension ID: idgpnmonknjnojddfkpgkljpfnnfcklj). It flags the presence of specific indexedDB LevelDB files and temporary directories that are characteristic of the malicious update, which was used for unauthorized data access and browser-based persistence.
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.
Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.
Detects creation of the lg.txt debug/failure log written by ChonkyChicken's filename-gating anti-sandbox check.
Detects regsvr32.exe silently registering an OCX file staged in a user-writable temp or local app data directory when spawned from a browser, shell, or Run-dialog parent process.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects a single Python process sequentially accessing all three sandbox/container-detection artifacts (.dockerenv, .containerenv, /proc/1/cgroup), the environment-fingerprinting technique used by the mrmustard stealer before executing its payload.
Detects creation of the mmcompat.pth file in Python site-packages, the mrmustard stealer's persistence mechanism designed to survive package uninstall.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects instances where a process other than the authorized password manager application (e.g., 1Password, Bitwarden, KeePass) attempts to create, modify, rename, or read sensitive database files associated with these password managers. This behavior may indicate an attempt to exfiltrate or compromise stored credentials.
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Detects the creation of a specific wallpaper file ('image_danger.jpg') associated with the GigaWiper malware family, which is indicative of a system defacement attempt during the destructive phase of an attack.
Page 65 of 139