Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects WinRAR application writing a shortcut (.lnk) file directly into the Windows Startup folder. This activity is indicative of exploitation of NTFS Alternate Data Stream (ADS) path traversal vulnerabilities (such as CVE-2025-8088 or CVE-2025-6218) to achieve persistence by placing a malicious shortcut in the user's startup directory without triggering typical user interaction warnings.
Detects the creation of an NTFS Alternate Data Stream (ADS) named :WDFOO on the wermgr.exe process within RP_* staged directories. This behavior is a specific indicator of the RoguePlanet exploit (CVE-2026-50656), which leverages an ADS write to trigger a Microsoft Defender on-access scan and facilitate a TOCTOU (Time-of-Check to Time-of-Use) race condition for privilege escalation or exploitation.
Detects a user-mode process attempting to set an opportunistic lock (oplock) on wermgr.exe within a Volume Shadow Copy (VSS) snapshot. This behavior is associated with the RoguePlanet exploit chain (CVE-2026-50656), which leverages VSS snapshots and file locking to trigger a TOCTOU race condition against the Microsoft Defender (MsMpEng.exe) scanner.
Detects the execution of Microsoft Edge via the command shell to open a PDF file. This pattern can be indicative of malicious activity where an attacker attempts to bypass direct execution or leverage a browser vulnerability to open a malicious PDF.
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
This rule detects potential ransomware activity by identifying processes that perform a high volume of file write, create, or rename operations across a large number of unique file paths within a short timeframe. It also includes a heuristic check for filenames containing 'inc' or 'lynx', often associated with specific ransomware variants.
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder.
This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.
This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.
Detects file creation or write access to C:\Windows\System32\sethc.exe or sethc.exe.bak, indicating a sticky keys backdoor technique where an attacker replaces the Sticky Keys binary with cmd.exe or another shell to obtain a SYSTEM-level shell at the login screen.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
Detects Millenium RAT writing captured keystrokes to specific obfuscated file paths or staging files. This behavior includes the creation of keylogger output files within a uniquely named AppData subdirectory (GTR1YB4A7s) or a temporary staging file (C:\debug.txt), which are artifacts used by the RAT before data exfiltration.
Detects DLL sideloading behavior where 'Mixed Reality.exe' loads the 'nvdaHelperRemote.dll' library from the Windows Media Player directory, rather than the legitimate NVDA installation path. This is a characteristic indicator of the Silver Fox threat activity associated with Operation DragonReturn.
Detects path traversal exploitation attempts targeting Dell Wyse Management Suite (WMS) processes or Java components, specifically looking for attempts to access sensitive system files such as SAM, NTDS.dit, or registry hive files via directory traversal sequences.
This rule detects processes running from non-standard locations (specifically within application data directories) that perform both file system write operations for media or image formats (indicative of screen, audio, or video capture) and simultaneously initiate outbound network connections to non-private IP addresses. This behavior is often characteristic of spyware, unauthorized remote access tools, or malware attempting to capture and exfiltrate user activity.
Detects the presence of BeepRAT-related shellcode loader files (config.ini.c or temp.bin) located within a TCC (Tiny C Compiler) directory. These artifacts contain specific shellcode for hash-based API resolution, a technique used to dynamically resolve Windows API functions like LoadLibraryA and GetProcAddress to evade static analysis.
Detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a legitimate 'Perplexity AI' extension. This malware hijacks the browser's default search provider to redirect traffic to 'perplexity-ai.online'.
Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.
This rule monitors for potential spearphishing campaigns by tracking two behaviors: the delivery of emails containing known malicious URLs or lure-themed attachment names via email gateway logs, and the subsequent execution of files extracted from archives or matching lure patterns by EDR agents on endpoints.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects potential malicious activity characterized by a high volume of file write operations (at least 20 within a 30-minute window) followed by an attempt to delete those files or the files themselves. The rule monitors Sysmon events, specifically looking for processes that exhibit significant write behavior and then initiate a deletion command via cmd.exe, PowerShell, or the native Windows MoveFileEx self-deletion mechanism.
Detects malicious .jse loader scripts associated with Kimsuky's NUKESPED malware family. The rule identifies suspicious behaviors including the creation of Scripting.FileSystemObject for filesystem manipulation, use of GetSpecialFolder for staging, and file system enumeration via GetFile, which are key components of the threat's payload delivery and staging process.
Detects file creation or renaming events associated with JFMBackdoor, including unauthorized file manipulation in common system locations and the presence of known backdoor component filenames. It also monitors for suspicious file attribute manipulation performed by processes running from temporary directories.
Page 73 of 139