Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects non-browser processes (e.g., non-chrome.exe/msedge.exe) modifying critical browser configuration files such as 'Secure Preferences' followed by near-simultaneous writes to extension-related directories like 'Extension State' or 'Extensions'. This pattern is indicative of a malicious attempt to bypass browser security integrity checks to silently install or load unauthorized extensions.
Detects Impacket-style hands-on-keyboard staging: a NeedyMantis bundle file dropped by cmd.exe/wmiprvse.exe/services.exe carrying the distinctive remote-execution fingerprint (ADMIN$ share reference, %COMSPEC% invocation, or 2>&1 output redirection used by wmiexec/smbexec/atexec), followed within 15 minutes by execution referencing the same bundle folder with the same fingerprint. Requiring the ADMIN$/%COMSPEC%/redirection fingerprint on both the copy and the execution -- rather than just matching on common process names like cmd.exe or svchost.exe -- removes the bulk of ordinary software installation and update activity that also uses cmd.exe to stage files.
Detects Impacket-style hands-on-keyboard staging: a NeedyMantis bundle file dropped by cmd.exe/wmiprvse.exe/services.exe carrying the distinctive remote-execution fingerprint (ADMIN$ share reference, %COMSPEC% invocation, or 2>&1 output redirection used by wmiexec/smbexec/atexec), followed within 15 minutes by execution referencing the same bundle folder with the same fingerprint. Requiring the ADMIN$/%COMSPEC%/redirection fingerprint on both the copy and the execution -- rather than just matching on common process names like cmd.exe or svchost.exe -- removes the bulk of ordinary software installation and update activity that also uses cmd.exe to stage files.
This rule detects potential backdoor deployment or persistence mechanisms in AI coding assistants like Claude Code and Cursor. It identifies when specific configuration or hook files (e.g., settings.json, hooks.js) are modified, followed within a two-hour window by the execution of suspicious child processes (e.g., powershell.exe, curl.exe, python) initiated by the coding assistant's CLI tool.
This rule detects the creation or modification of a DLL file within the 'ProgramData\CrossDevice' directory, or the modification of a specific COM CLSID InprocServer32 registry key associated with 'CrossDevice.Streaming.Source.dll'. This behavior is indicative of potential COM hijacking or persistence mechanisms targeting the CrossDevice streaming framework.
Detects unauthorized modifications to AI agent configuration files, including system prompts, tool allow-lists, and MCP server registration files. Such changes are often performed by processes outside of approved configuration management or infrastructure-as-code pipelines, potentially allowing for persistent manipulation of AI model behavior and capabilities.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
Detects potential runtime polymorphic malware that modifies its own executable or script content while simultaneously communicating with generative AI or LLM API endpoints. This behavior indicates an adversary using LLMs to regenerate obfuscated code or mutate malware signatures dynamically at runtime.
KQL Query
Detects unauthorized processes (excluding firefox.exe and explorer.exe) accessing or modifying sensitive Firefox browser profile files, specifically places.sqlite (history/bookmarks) and cookies.sqlite (session cookies). This activity is often indicative of credential or session hijacking attempts by malware or malicious scripts.
Detects the modification of AI agent configuration files (e.g., mcp.json, config.json) followed shortly by the agent spawning a child process that matches typical Model Context Protocol (MCP) server execution patterns. This behavior may indicate an attacker has modified the configuration to inject malicious server commands or tools that the AI agent will execute upon next initialization, effectively achieving persistent code execution via the agent's legitimate functionality.
Detects modifications to the creation time of web-accessible script files (.aspx, .php, .asp, .jsp) located in common web directories (wwwroot, inetpub). Adversaries often use timestomping to hide the creation of backdoored web shells, making them appear older and potentially bypassing forensic or integrity-checking mechanisms.
This rule detects the suspicious copying of a Chromium-based browser 'Web Data' file (which stores sensitive information like saved passwords, credit cards, or address data) to a temporary file, followed by an outbound network connection to a specific exfiltration endpoint pattern within a 30-minute window.
Detects the modification or creation of a 'loginwindow.plist' file within the '/Library/LaunchAgents/' directory, correlated with a process containing 'renderer' and 'launchctl' or 'LaunchAgents' in its command line. This pattern suggests potential persistence mechanisms being established by a renderer process (e.g., an Electron-based application or browser process).
Detects the MSBuild.exe process adding new root or intermediate certificate authorities to the Windows certificate stores. This activity is indicative of potential malicious PKI infrastructure staging, which can be used to facilitate adversary-in-the-middle (AiTM) attacks or bypass certificate validation.
Detects instances where the Redis server process or the Redis AOF check utility writes directly to common SSH authorized_keys file paths. This behavior is indicative of an attacker exploiting a Redis misconfiguration or vulnerability (e.g., Redis RCE) to establish persistence by injecting an unauthorized SSH key.
Detects attempts to modify the Redis configuration (dir or dbfilename) followed by a SAVE command, which can be leveraged to write arbitrary data to critical system files such as crontabs for persistence.
Detects potential abuse of Cloud Shell to persist access in cloud environments. For GCP, it monitors the injection of SSH keys into instance or project metadata from a Cloud Shell session. For Azure, it detects a pattern involving Cloud Shell storage provisioning followed by a subsequent VM run-command or SSH public key update, indicating potential unauthorized management of virtual machines.
This rule detects unauthorized access, creation, or modification of Git credential files (.git-credentials, .netrc) by processes other than standard Git credential management utilities. It also monitors command-line activity that references these credential stores to identify potential attempts to exfiltrate or manipulate stored credentials.
Page 10 of 109