Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the creation of PNG screenshot files with a specific directory naming convention (numeric subdirectory containing numeric filename) associated with the GigaWiper destructive malware.
Detects the creation of files within the 'ProgramData\output\' directory, a pattern associated with the GigaWiper malware which utilizes this location to store captured screen recordings or screenshots during its operation.
This rule detects the presence of a specific file named 'g11.sys' being loaded or accessed on a system, followed by the execution of 'sc.exe' to register or create a system service involving the same driver file. This pattern is commonly associated with the installation of kernel-mode drivers, which could be part of a rootkit deployment or a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Detects the creation of PNG screenshot files with a specific directory naming convention (numeric subdirectory containing numeric filename) associated with the GigaWiper destructive malware.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
This rule is designed to reconstruct an investigative timeline around a specific device and timestamp identified by an initial network event. It aggregates process execution, file activity, network connections, and alert evidence from the affected device within a specified time window before and after the triggered pivot event, facilitating incident investigation and root cause analysis.
Detects the creation of SQLite database files associated with the LabubaRAT malware implant. The rule monitors for the nvidia-sysruntime.exe process creating specific database files (nvctr_sys.db and its associated journal/shared memory files) which are used for staging collected data.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects execution of the process named nvidia-sysruntime.exe, which is identified as a malicious component associated with LabubaRAT. The rule monitors for file system events triggered by this specific binary, which is masquerading as a legitimate NVIDIA component.
Detects file creation or deletion activity performed by nvidia-sysruntime.exe, the process name used by LabubaRAT, consistent with its RAT tasking module supporting delete and mkdir actions on the local filesystem.
Detects file creation or deletion activity performed by nvidia-sysruntime.exe, the process name used by LabubaRAT, consistent with its RAT tasking module supporting delete and mkdir actions on the local filesystem.
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
Detects unauthorized creation or modification of persistent-state files used by AI agents (e.g., AGENTS.md, MEMORY.md). Such files can be poisoned to manipulate the AI agent's objective knowledge or behavior if the content is sourced from untrusted external inputs like email rather than explicit user instructions.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Detects processes other than the authorized system processes ('security' and 'securityd') interacting with the login.keychain-db file. Adversaries often target this file to extract stored credentials from the macOS keychain.
Detects new file creation or modification events within the /Library/Caches/ directory of user profiles on macOS. Adversaries may utilize these directories for persistence, staging, or hiding malicious payloads.
Detects static HTML/JS/CSS artifacts matching the DEBULL device-code phishing template via admin.css SHA256, Composer content-hash, and Turkish-language code markers
This rule detects the creation of specific SQLite database files ('nvctr_sys.db', 'nvctr_sys.db-wal', 'nvctr_sys.db-shm') associated with the LabubaRAT malware family. These files are used by the malware to stage collected data locally before exfiltration.
Page 68 of 139