Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
Detects Millenium RAT establishing persistence by creating a Registry Run key (MsEdgeUpdate) that executes a binary named svchost.exe from an obfuscated AppData subdirectory, or identifies general persistence attempts by creating Registry Run keys pointing to executables within user-writable AppData or Temp directories.
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Detects the presence of a specific global event object 'Global\ShitSetupOn26126k' used as a mutex or single-instance check by the DragonReturn malware dropper.
This rule detects potentially unauthorized installation of extensions in Visual Studio Code (VSIX) or plugins in JetBrains IDEs (IntelliJ, PyCharm, WebStorm). It flags installations that do not originate from verified official marketplaces, which may indicate the manual installation of malicious or supply-chain compromised development environment extensions.
This rule detects potentially malicious email attachments masquerading as 'Distribution Settlement Agreements'. It flags PDF attachments that match these specific filenames when delivered in emails associated with identified suspicious domains (gasparinutrition.com, gappssmtp.com) or when authentication checks like DMARC fail.
Detects the installation or presence of a specific malicious Chromium browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) associated with Perplexity AI-themed phishing or malicious activity. The rule monitors file system events, process command lines, and registry modifications related to the Chrome Extensions directory.
Detects the presence of known malicious Chrome extension IDs, suspicious configuration files (e.g., perplexity-rules.json, bing-rules.json), or extensions utilizing invasive declarativeNetRequest permissions, which are often used for browser-based exfiltration or credential interception.
Detects the presence of specific file artifacts (extension ID 'flkebkiofojicogddingbdmcmkpbplcd' and associated traffic routing configuration files) belonging to a malicious Chrome extension that leverages declarativeNetRequest permissions to redirect browser traffic through an attacker-controlled relay domain.
Detects the creation of Model Context Protocol (MCP) server configuration files (e.g., mcp.json) in workspace directories triggered by process executions typically associated with package installation tools such as npm, npx, pip, or python. This behavior can indicate the installation of a malicious or typosquatted package designed to register a malicious MCP server and facilitate credential theft or unauthorized access.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by attacker to block EDR/AV components while allowing their own malicious code to run on the system.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
This rule detects file access events involving specific file names ('DscCoreR.mui', 'SyncRes.dat', 'GameInputInboxs32.mui', 'diagerr.xml', 'NtfsLog.etl', 'Ignored.Dat', 'VistaCompat.nls') that have been historically observed as indicators of the HUI Loader malware. HUI Loader is a custom DLL loader used by various threat actors to sideload malicious payloads.
Detects instances of the wusvc.exe process being executed and subsequently performing file write or module load operations. This pattern is often used by adversaries to mask malicious activity by masquerading as the legitimate Windows Update service.
Detects the creation of a registry run key entry in HKLM that points to an executable named 'browser.exe' located within a user's AppData\Local directory, specifically matching a GUID-based subfolder structure. This behavior is indicative of malicious persistence mechanisms, where an adversary attempts to execute a masqueraded binary upon system startup.
Detects the creation of specific file artifacts associated with the VILE ransomware. The VILE ransomware Go-based binary is known for employing ETW tracing suppression and direct NT system calls to bypass EDR user-mode hooking. Identifying these unique filenames on the host acts as a high-fidelity indicator that the VILE binary is actively present and executing.
This rule detects the presence of Phoenix malware by identifying known SHA256 hashes of its components or network connections to its command and control (C2) infrastructure. It correlates file events with known malware hashes and network events with known C2 IP addresses.
Detects LampoRAT malware based on known file hash execution.
Page 76 of 139