Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects modifications (such as write, rename, create, or delete events) to critical Linux system files including SSH binaries (sshd, ssh, scp) and PAM authentication modules (pam_unix.so). These files are common targets for adversaries seeking to establish persistence, bypass authentication mechanisms, or gain unauthorized access to credentials.
Detects the use of the legitimate Windows utility fltMC.exe to perform timestomping (modifying file timestamps) on specific malicious or deployment-related files (such as FLTLIB.dll, scr.mui, and flt.bin) located in temporary directories. This activity is associated with the JFMBackdoor used by the Red Lamassu threat actor to evade timeline-based forensic analysis.
Detects the creation or modification of shared object (.so) files within critical Linux PAM library directories (/lib/security/, /lib64/security/, /usr/lib/security/) by processes other than identified system package managers. This behavior is indicative of an adversary replacing legitimate authentication modules with malicious versions to capture credentials or establish persistence, such as the activity documented in Operation Highland (Velvet Ant).
This rule monitors for file system operations (creation, modification, deletion, or renaming) performed by a Node.js process when interacting with sensitive directories and files associated with web browser extensions and cryptocurrency wallets. This pattern is commonly observed in credential and private key theft activities where malicious scripts attempt to exfiltrate wallet data.
Detects node.exe (often associated with malicious npm package runtimes) accessing local credential store files such as KeePass, 1Password, and Bitwarden. This activity is indicative of infostealer payloads (e.g., Miasma/MYRA) targeting developer workstations to exfiltrate sensitive credential databases.
Detects the execution of PowerShell with the 'Expand-Archive' cmdlet originating from a suspicious or non-standard parent process. This pattern is commonly used by malware loaders, such as Amadey, to unpack second-stage payloads like StealC from downloaded ZIP archives hidden in temporary application folders.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
Detects the TonRAT malware establishing persistence by writing node.exe or JavaScript file paths into Windows registry Run or RunOnce keys. This activity, often involving paths within AppData or ProgramData, is a common indicator of persistence mechanisms used by TonRAT, as observed in the Photo ZIP hospitality campaign.
This rule monitors file system events for the creation of files with common web shell names (e.g., shell.php, cmd.php) within known web server directory paths (e.g., wwwroot, inetpub). The detection of these specific file names in directories typically used for serving web content is a strong indicator of a potential web shell deployment.
Detects the confirmed-malicious CRX (Chrome) and XPI (Firefox) extension package hashes for the VPN Go campaign on endpoints. Map to your EDR file-hash field (e.g. Hashes / sha256).
Detects unauthorized processes reading or opening files located within the data directories of Discord or Telegram Desktop. These directories often store sensitive user data, including session tokens and local databases, which are common targets for info-stealing malware.
This rule detects the creation of files with specific suspicious names or within a specific suspicious directory path under the user's AppData Roaming folder, which is commonly used for persistence by malware or unauthorized tools.
Detects malicious process, file, and registry activities associated with Hannibal Stealer staging directories and characteristic command-line execution patterns, specifically targeting indicators like CefSharp.BrowsersSubprocess and specific DLL function delegates used in staging.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects processes attempting to access sensitive Linux system files (/proc/[pid]/environ or /proc/[pid]/cmdline) or the specific file 'linux-process-env.json'. Such actions are indicative of an adversary attempting to perform system discovery, dump process environment variables for secrets, or collect process metadata.
Detects potentially malicious activity associated with the Ghidra reverse engineering framework, including the spawning of unexpected non-Java child processes, loading of suspicious project files (.gzf/.gar), loading of unsigned extensions from non-standard directories, and unexpected outbound network connections from decompiler or Java processes.
Detects potential ransomware activity characterized by a high volume of file modifications (create, write, rename) involving common document/data extensions, combined with the execution of commands designed to inhibit system recovery (shadow copy deletion, BCD modifications) or perform network share enumeration within the same timeframe and on the same host.
This rule detects PowerShell processes initiated where the command line contains references to specific files ('vile_Decryptor.lnk' or 'vile_icon.ico'), which are indicative of suspicious shortcut file execution or associated malware staging activity.
Page 78 of 139