Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the creation of PNG screenshot files with a specific directory naming convention (numeric subdirectory containing numeric filename) associated with the GigaWiper destructive malware.
Detects the creation of files within the 'ProgramData\output\' directory, a pattern associated with the GigaWiper malware which utilizes this location to store captured screen recordings or screenshots during its operation.
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
This rule detects the creation or presence of a file named 'kbdus1.dll' within the Windows System32 directory. This filename is designed to look like the legitimate Windows keyboard layout DLL 'kbdus.dll' by appending a '1'. Threat actors, specifically associated with the Stupig backdoor, utilize this masquerading technique to blend in with legitimate system files and evade detection by security monitoring tools that rely on filename-based filtering.
This rule detects potentially unauthorized or suspicious developer activity, specifically focusing on the execution of custom scripts like 'temp_auto_push.bat', automated task execution via VS Code 'tasks.json' files, and git commands that bypass security checks using '--no-verify'. These activities may indicate repository tampering, modification of source code integrity, or attempts to automate actions that circumvent established development workflows.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects the Cursor IDE (Cursor.exe) executing a process named git.exe from a file path outside of the standard Git installation directory (typically under Program Files). This behavior is indicative of an attacker placing a malicious git.exe binary within a repository directory to facilitate automatic execution and potential command execution when the folder is opened within the IDE, bypassing standard security trust prompts.
This rule detects file creation, renaming, or modification events targeting files associated with cryptocurrency wallets, such as wallet.dat or files containing the string 'keystore'. Accessing these files is a common technique used by malware or malicious actors to steal cryptocurrency credentials and private keys.
Detects the loader-pool.db PNG-format file used to smuggle encrypted payload modules inside IDAT chunks, reassembled after a sleep-based evasion delay
Detects the presence or loading of files named 'profiler16.dll' or 'loader-pool.db', which are associated with in-memory payload staging and execution techniques typically used by IDAT (a modular, multi-stage loader).
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects the mrmustard stealer's compiled-bytecode artifacts (hw_probe.pyc, .lock_*, .ts_*) dropped in the hidden .tf_cache directory used to evade static source-code review.
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects the HelloNet campaign's persistence technique in which itcsrvup64.exe (ViPNet Update System, part of ViPNet Client) sideloads a malicious wtsapi32.dll from the ViPNet Update System directory to execute a payload at OS startup.
Detects the creation of a specific wallpaper file ('image_danger.jpg') associated with the GigaWiper malware family, which is indicative of a system defacement attempt during the destructive phase of an attack.
Detects the creation of files within the 'ProgramData\output\' directory, a pattern associated with the GigaWiper malware which utilizes this location to store captured screen recordings or screenshots during its operation.
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Page 66 of 139