Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the Cursor IDE (Cursor.exe) or its child processes accessing sensitive SSH private key files or cloud provider authentication credentials. This behavior is indicative of a compromised IDE process, potentially leveraging malicious extensions or MCP (Model Context Protocol) servers to exfiltrate secrets from the local filesystem.
Detects attempts to grant world-writable (0666) permissions to the /dev/kvm device node using chmod or setfacl, or unauthorized (non-root) accounts interacting directly with the device. Such configuration changes are associated with the Januscape (CVE-2026-53359) vulnerability, which allows local users to exploit a shadow MMU use-after-free in the kernel to escalate privileges to root or escape into the host from a virtualized environment.
Detects the presence of the PoisonX malicious kernel driver (g11.sys), which is used by the Hyadina group in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software and disable user-mode API hooks.
This rule detects attempts to directly access and modify raw disk devices, a technique commonly used by wiper malware like GigaWiper. It monitors for operations involving raw physical disk paths (e.g., \\.\PhysicalDrive) in conjunction with strings indicative of disk destructive routines such as partition removal, disk creation IOCTLs, or raw drive handle manipulation.
Detects read, creation, or modification events involving common cryptocurrency wallet files (e.g., wallet.dat) or directories associated with wallet applications (Exodus, Electrum, Ledger Live) located within user application support directories. This behavior is indicative of credential access attempts where an adversary is trying to steal private keys or wallet data.
This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.
Detects access, creation, or modification of sensitive browser files (Cookies, Login Data, Local State) associated with Google Chrome or Microsoft Edge. The rule specifically flags when these files are interacted with within standard user directories or when they are copied to known browser backup folders, a common behavior during credential theft or data staging.
These YARA rules detect indicators of compromise (IOCs) associated with a campaign where malicious actors compromised developer accounts to distribute malicious Google Chrome extensions. The rules search for a specific set of C2 IP addresses, domains, extension names, and unique extension IDs known to be part of this supply chain attack.
These YARA rules detect encrypted ZIP archive files that contain exactly one file. Specific variations are provided for ZIP files containing a single .vbs or .msc file. This pattern is commonly used in malware distribution via email to bypass static security controls, requiring user interaction to decrypt and execute the payload.
This rule detects the installation of a specific potentially malicious NPM package ('mouse5212-super-formatter') via the npm command-line interface, followed by the execution of a node process initiated by the npm command within a 5-minute window. This behavior is indicative of a software supply chain attack where a developer or automated process is tricked into installing a backdoored dependency that subsequently executes malicious code.
This rule detects potential ransomware activity or bulk file manipulation by monitoring for a high volume of file write, rename, or creation events performed by a single process within a one-minute window. It calculates the frequency and variety of unique files touched to identify potentially malicious automated encryption or data destruction behavior.
Detects mass file renaming activities involving the '.Liushen' extension, commonly associated with the LIUSHEN ransomware behavior where files are appended with this extension after being encrypted.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects file creation or deletion activity performed by nvidia-sysruntime.exe, the process name used by LabubaRAT, consistent with its RAT tasking module supporting delete and mkdir actions on the local filesystem.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Detects a process attempting to delete its own executable file on disk. This is a common anti-forensic technique used by malware to hinder investigation and remove traces of its presence after execution.
Detects known malicious indicators, including C2 domain connections, suspicious file hashes, and specific mutexes often associated with malware execution.
This rule detects network connections to a suspicious domain associated with the 'Maccy' application, as well as file and process activity involving files named 'Maccy' that interact with the same suspicious domain. This is indicative of potential unauthorized application execution or malicious activity masquerading as the Maccy utility.
This rule monitors process command lines and file operations for specific strings associated with ransomware, including known ransom note naming conventions ('readme_ransom'), a specific Bitcoin wallet address, a contact email, and SQL commands commonly used to drop database tables for ransom purposes.
Page 69 of 139