Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects unauthorized processes attempting to access, modify, or create web browser data files such as 'Login Data' (credentials), 'Cookies', and 'Local State'. This rule identifies potential credential theft activity where non-browser processes interact with sensitive browser storage files, which is a common tactic used by info-stealing malware.
This rule detects the creation of files with NTFS Alternate Data Streams (ADS). Adversaries often use ADS to hide malicious payloads or tools within the file metadata of legitimate-looking files to evade static analysis and security monitoring.
This rule detects the execution of the QEMU virtualization engine (qemu-system-x86_64.exe) when associated with specific toolset files (e.g., BloodHound, Metasploit) or suspicious network activity patterns indicative of lateral movement, such as connecting to administrative ports (SMB, RDP, WinRM) on external or sensitive network ranges. The rule calculates a risk score based on the presence of these indicators.
Detects BQTLock ransomware activity where the BQT.exe process accesses browser credential stores (Chrome, Firefox, Opera) and writes the extracted data to a temporary file at C:\Windows\Temp\bqt_passwords.txt.
This rule detects a suspicious volume of file copy activity (over 200 files) to a non-local drive (potentially a removable/USB device) occurring within 24 hours of an account being deleted or disabled on the same host. This pattern may indicate an insider threat or an adversary attempting to exfiltrate sensitive data shortly before or after losing authorized access to an account.
This rule detects unauthorized attempts to create, modify, rename, or delete sensitive browser data files (such as Login Data, Cookies, key4.db, and logins.json) used for storing credentials. It monitors for access by processes that are not known browser executables or authorized system services, which is a common indicator of credential dumping by malicious software.
Detects unauthorized processes attempting to read, modify, create, or rename browser sensitive data files such as 'Login Data' (passwords) and 'Cookies' for Google Chrome and Microsoft Edge. This activity is a common indicator of credential theft or session hijacking.
This rule detects file system artifacts and network activity associated with a malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). The extension utilizes service workers to intercept browser search queries and capture keystrokes, subsequently exfiltrating the data to an attacker-controlled domain.
This rule detects files created where the internal 'FileCreationTime' significantly deviates from the actual observed file-creation time. Specifically, it identifies files created more than 30 days in the past or with a future creation timestamp, which are common indicators of timestomping techniques used to hide malicious files or evade time-based forensic analysis.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
Detects rapid file renaming of user-critical documents and media files to an .encrypted extension, indicative of mass file encryption activity typically associated with ransomware.
Detects the execution of PowerShell with hidden window styles originating from a shortcut (.lnk) file. This behavior is commonly associated with malicious LNK files masquerading as PDF documents, often used as an initial access vector to launch stage-one payloads from temporary directories.
Detects Windows executables that write files with suspicious extensions
Detects DLL side-loading activity associated with the Kazuar backdoor, where legitimate executables (LaunchGFExperience.exe or vncutil64.exe) are executed from unusual directories (Brother Printer or Sony Audio drivers) to load a malicious DLL (LaunchGFExperienceLOC.dll).
Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.
Detects the presence of file system artifacts associated with a malicious Chrome extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a 'Perplexity AI' search tool. This extension is known to hijack browser search queries by redirecting them through the typosquatted domain 'perplexity-ai.online'.
Detects the presence of the malicious Chromium extension 'Search for perplexity ai' (ID flkebkiofojicogddingbdmcmkpbplcd) on disk. This extension hijacks browser default search settings to redirect queries through the typosquatted domain perplexity-ai[.]online.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule monitors for file system activity associated with the 'libpwn' exploit suite, specifically targeting files related to the exploitation of CVE-2026-55200. It flags the presence of exploit harnesses, probes, and proofs of concept (PoCs) identified by specific filenames and directory structures.
Detects WinRAR.exe writing files to sensitive directories such as the Startup folder or C:\ProgramData, potentially indicative of exploitation of path traversal vulnerabilities (CVE-2025-8088, CVE-2025-6218). This activity is associated with UAC-0226's use of WinRAR to establish persistence or stage malicious payloads.
Page 72 of 139