Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects unsigned processes creating directories and dropping multiple suspicious files (DLLs, executables, crypto libraries) in AppData Temp folders which may indicate malware staging behavior
Detects file creation in Windows Startup folders which is a common persistence mechanism used by malware. Focuses on executable file types (.exe, .scr, .bat, .cmd, .vbs, .lnk)
This rule detects the creation or modification of Chrome extension files (.crx) on a device, correlating it with browser extension installation/update events and file prevalence. It flags extensions that are rare, unsigned, small in size, or have suspicious IDs, indicating potential malicious activity or unauthorized installations.
Detects the modification or deletion of specific JavaScript or Python files shortly after a Node.js or Python interpreter starts. This behavior is characteristic of the 'self-patching' and 'evidence removal' techniques used by the Lazarus Group's Graphalgo malware.
Detects suspicious file staging activity in Temp directory structures commonly used for data exfiltration preparation. Includes credential folders, system information collection, and archive creation
This rule detects the deployment and potential abuse of Velociraptor, a DFIR (Digital Forensics and Incident Response) tool. It identifies Velociraptor by monitoring file creation/modification in common installation paths and for its executable name, process execution, and the creation of suspicious child processes (like PowerShell, cmd, curl, wget) by Velociraptor. The rule also attempts to correlate these activities to determine the severity of the detection, indicating potential post-exploitation activity.
Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
Detects modification of critical ICONICS Suite configuration files by unauthorized processes. Attackers can modify these files, such as changing the SMSLogFile path in IcoSetup64.ini, to redirect privileged file writes for privilege escalation or DoS, as seen in the CVE-2025-0921 exploit chain.
This rule detects potential malware execution and persistence by correlating suspicious script and HTA activity with known malicious infrastructure. It flags mshta, wscript, and cscript executing remote HTA or script content, related network connections and downloads, temporary file artefacts, connections to listed suspicious domains and IPs, attempts to add Windows Defender exclusions, and fake browser update style process launches that retrieve executables over HTTP.
Detects indicators of compromise related to trojanized ScreenConnect installers and abuse of ScreenConnect C2 configuration. This rule identifies suspicious process executions of ScreenConnect components, known malicious hashes associated with ScreenConnect malware, ScreenConnect processes launched by installer executables (msiexec), network connections to ScreenConnect relay domains, DNS resolutions for ScreenConnect relays, modifications to 'system.config' files within ScreenConnect directories indicative of C2 configuration, and malicious registry artifacts related to ScreenConnect installation.
Detects the creation of a directory junction pointing to a OneDrive synchronization folder. This is a key component of the 'DoubleDrive' technique, used to force the synchronization of arbitrary local files for data exfiltration or cloud-based ransomware encryption.
Detects modification of core OpenClaw AI agent behavioral files (SOUL.md, AGENTS.md). Threat actors have been observed using malicious 'skills' to append instructions to these files, creating a 'cognitive rootkit' that persistently alters the agent's behavior.
Detects the creation or modification of a `.vscode/tasks.json` file that is configured to automatically run a task when a folder is opened.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Detects the modification of a `.vscode/settings.json` file to include a `PROMPT_COMMAND`. This technique allows an attacker to execute arbitrary commands every time a new terminal is opened in a Linux-based VS Code environment, such as GitHub Codespaces. It can be used for persistence or to exfiltrate credentials and secrets.
Detects the creation or modification of the SimpleHelp RMM configuration file (serviceconfig.xml). Threat actors have been observed using SimpleHelp as part of a chained RMM attack, and this file contains the C2 server configuration.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Lockbit ransomware drops 9 character alphanumeric .ico and a README.TXT file
Detects the creation or modification of a browser extension's manifest.json file configured to inject a script into the 'MAIN' world context of chatgpt.com. This technique allows the extension to bypass the isolated content script environment, hook native APIs like window.fetch, and steal session tokens, as seen in a campaign targeting ChatGPT users.
Page 101 of 109