Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Loader malware delivering follow-on ransomware payloads
This rule detects the creation of directories or files within the '\Temp\' directory that match a specific naming pattern ('RP_' followed by an alphanumeric string). This pattern is often associated with the creation of temporary artifacts by scripts, installers, or malicious payloads.
Detects the presence of files known to be associated with malicious activity by matching their SHA256 hashes against a list of known bad indicators.
This rule detects post-click execution chains typical of RomulusLoader delivery, specifically identifying when browser or archive applications launch unsigned processes from user-writable directories (e.g., Downloads, Temp), or when a suspicious vulkan-1.dll module is sideloaded from these same directories.
Open-source derived remote access trojan with plugin architecture
Detects the creation of executable files (.exe or .dll) on a removable drive followed by the execution of a process from that same drive within a 30-second window. This behavior is indicative of an adversary using removable media to stage and execute malicious payloads.
Detects instances where DllHost.exe creates executable or script files within sensitive Windows directories (e.g., Public, Temp, ProgramData). This behavior is often indicative of WSL2 filesystem proxying, where a Linux process initiates a file write to the Windows filesystem via /mnt/c/, causing the DllHost.exe process to proxy the write operation and obscuring the original Linux process origin.
Detects instances where DllHost.exe (COM Surrogate) creates executable or script files in high-risk, user-writable directories. This activity is indicative of potential exploitation of the Windows Subsystem for Linux (WSL2) filesystem proxy, where a Linux process running within WSL2 writes files to the Windows host filesystem (/mnt/c/), resulting in the file creation event being attributed to the DllHost.exe COM surrogate on the Windows side.
Detects the creation of executable files with suspicious naming patterns within the C:\ProgramData directory. The rule filters for files with specific file extensions or high-entropy name patterns that do not match common Windows executable file types, potentially indicating staging of malicious payloads.
Detects macOS binaries that employ dynamic API resolution by using 'dlsym' and 'dlopen' to resolve sensitive functions like 'SecTrustSetAnchorCertificatesOnly' or 'IOPMAssertionCreateWithName' at runtime. This technique is often used to avoid static analysis by bypassing import table monitoring and string extraction.
This rule detects modifications to the Winlogon Shell registry key or a specific 'MyStartupScript' registry Run key. These locations are commonly abused by the LCRYX ransomware to establish persistence via VBScript or script host execution. The rule monitors both EDR registry events and Sysmon event ID 13 for suspicious changes performed by script host processes or targeting these specific persistence locations.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects the execution of specific suspicious files (nvdaHelperRemote.dll or Mixed Reality.exe) when they originate from within the 'Windows Media Player' directory. Such behavior is indicative of potential DLL search order hijacking or masquerading attempts, where an adversary places malicious files in a predictable location to intercept execution.
Detects processes running at High or System integrity levels that correlate with the creation of specific file artifacts known to be associated with VILE ransomware. The rule monitors for potential privilege escalation or token manipulation indicative of the ransomware's attempt to gain necessary permissions for encryption operations.
Detects suspicious activity originating from web application processes (python, uvicorn, gunicorn) involving the download and execution of a payload (isp.sh), followed by the deployment and execution of a binary (lambsys) within hidden directories in /var/tmp/. This rule flags indicators of compromise such as curl/wget calls to suspicious IPs, creation of hidden directories, and execution of binary files in temporary storage locations.
Detects 7-Zip (7z.exe / 7zG.exe) writing executable files to user-accessible directories, potentially leveraging CVE-2026-46331. This vulnerability allows an adversary to manipulate the Zone.Identifier Alternate Data Stream (ADS) of extracted files by embedding a crafted RAR5 stream, effectively setting the ZoneId to 0 (My Computer) and bypassing Windows SmartScreen warnings upon subsequent execution.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects DLL side-loading behaviors associated with the Grandoreiro banking trojan. The rule identifies malicious DLLs compiled with Delphi/Embarcadero, utilizing sgcWebSockets for C2 communication via WebRTC, and including specific anti-analysis and banking-related strings, often executed via legitimate software binaries.
Detects the execution of suspicious files that exhibit characteristics of finance-themed malware droppers. This includes files with known malicious MD5 hashes, specific internal file metadata (original filename, file description, product name), or filenames masquerading as financial documents (e.g., 'GST Debit Note', 'RTGS_IMPS') with an executable extension like '.com'.
Detects the use of rundll32.exe to process files with common image extensions (.jpg, .jpeg, .png, .bmp, .gif). This behavior is often associated with steganography or attempts to disguise malicious payloads by masquerading them as image files.
Page 61 of 80