Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects behavior where the ERAAgent process writes a file to disk and executes that same file shortly after (within 5 minutes). This pattern is consistent with staged payload delivery, decompression, or assembly often observed in malicious activity, specifically referencing SLEEPWALKER malware patterns.
Detects behavior where the ERAAgent process writes a file to disk and executes that same file shortly after (within 5 minutes). This pattern is consistent with staged payload delivery, decompression, or assembly often observed in malicious activity, specifically referencing SLEEPWALKER malware patterns.
Detection rule for a specific Rust-based Windows x64 backdoor known as C2Looper. The rule uses file hashes, debug strings, hardcoded configuration files/paths, and specific C2 API endpoints to identify the malware presence.
Detects WordlistLoader binaries containing the decode-and-execute routine that reconstructs shellcode via a wordlist mapping or UUID string array, then marks it RWX before invoking the entry point
Detects the creation or renaming of a file named 'pld.exe' within the AppData Local directory. This path is frequently used by malware to masquerade as legitimate applications and establish persistence while avoiding scrutiny.
Detects the creation of .php files within the wp-content/uploads directory tree by common web server or PHP-FPM processes. This behavior is indicative of an adversary attempting to drop a web shell via file upload bypass vulnerabilities, such as those exploiting MIME-type manipulation.
Detects the presence of the msaRAT MSI dropper (update_ms.msi) and its associated embedded payload (lib.dll), identified by the 'RUN' export and specific msa* string bindings used for inter-process communication or internal functionality.
Identifies core Windows subsystem binaries executing from any location other than System32. Binaries such as lsass.exe, winlogon.exe, services.exe and svchost.exe are never legitimately relocated or bundled by third-party software, so execution from an unexpected path indicates an adversary has placed a renamed or copied payload to blend in with normal process listings.
The detection uses a composite name-and-path key rather than checking either value independently, which catches relocation while permitting the genuine SysWOW64 copy of svchost.exe. Device paths reported by early-boot processes are normalised rather than excluded so that a genuine hit from a device path still fires. Scope is limited to Windows endpoints via DeviceInfo.
The detection uses a composite name-and-path key rather than checking either value independently, which catches relocation while permitting the genuine SysWOW64 copy of svchost.exe. Device paths reported by early-boot processes are normalised rather than excluded so that a genuine hit from a device path still fires. Scope is limited to Windows endpoints via DeviceInfo.
Detects the parsing of Mach-O headers for files with specific, potentially anomalous extensions. This is often used to identify masqueraded executables, unsigned binaries, or files with suspicious RPath configurations that may indicate malicious activity.
This rule detects potential Bumblebee loader activity by identifying files named 'msimg32.dll' that possess specific known builder file versions and exhibit anomalous, dictionary-derived 'gibberish' entries within their PE version information metadata fields (Comments, CompanyName, or FileDescription).
Detects BumbleBee loader binaries that utilize the GetSystemDefaultLocaleName API to perform geofencing, intentionally exiting if the system locale matches specific CIS (Commonwealth of Independent States) region strings. This behavior is used by the malware to avoid infection of systems in these regions.
This rule detects the creation of potentially malicious web-accessible files (e.g., .aspx, .ashx, .asmx) within sensitive SharePoint directory paths by the w3wp.exe process. This behavior is indicative of a webshell upload, which is a common persistence mechanism used by adversaries after gaining access to a web server.
This rule detects the creation of potentially malicious web-accessible files (e.g., .aspx, .ashx, .asmx) within sensitive SharePoint directory paths by the w3wp.exe process. This behavior is indicative of a webshell upload, which is a common persistence mechanism used by adversaries after gaining access to a web server.
Detects executables launched by common LOLBins (msiexec, powershell, cmd, wscript, cscript, regsvr32, rundll32)
that are either signed by a non-Microsoft/non-trusted-third-party publisher, or entirely unsigned.
that are either signed by a non-Microsoft/non-trusted-third-party publisher, or entirely unsigned.
Detects the creation of executable script files (PHP, ASP, ASPX, JSP) by web server worker processes (e.g., httpd, nginx, w3wp.exe, php-fpm). This behavior is strongly indicative of the final stage of a web exploitation workflow where an attacker writes a web shell to the server to establish persistence or remote command execution capabilities.
This rule detects potentially malicious child processes spawned by LOLBins (Living Off the Land Binaries) like mshta.exe, wscript.exe, cscript.exe, rundll32.exe, or regsvr32.exe, which were themselves initiated by document applications (e.g., Office, Acrobat) or common shell interpreters. It specifically identifies downstream payloads that are either unsigned or signed by non-trusted publishers, filtering out Microsoft and common third-party software signers.
This rule detects the execution or presence of known malicious JavaScript loader files identified as part of a banking-lure phishing campaign by matching their SHA256 file hashes.
Detects the execution of an executable file initiated by npm during the postinstall process. This behavior is often indicative of a software supply chain attack where a malicious package executes code immediately after installation.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the execution of msiexec.exe to install ScreenConnect.ClientSetup.msi when initiated from user-controlled directories like Downloads or Temp folders. This behavior is indicative of potential social engineering or phishing attacks leveraging legitimate remote access software installers.
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
Page 52 of 80