Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects behaviors associated with the LCRYX VBScript ransomware, including modification of the hosts file to block security sites and the download of additional malicious payloads from known malicious URLs.
Detects suspicious file writes or modifications within the 'CryptnetUrlCache' directory. Malware abuses this directory to hide payloads and configuration files, blending in with legitimate system activity.
Detects a sequence of file operations indicative of CLFS Base Log File (.blf) tampering, a technique used in CVE-2024-49138 exploitation. The detection looks for a process writing to a .blf file, immediately followed by a read of the same file, which is an unusual pattern as regular applications use CLFS APIs, not direct file writes.
This rule detects the 'Zip Slip' vulnerability pattern within incoming ZIP archives. Specifically, it looks for the sequence '..\' (dot dot backslash) in the file data of a ZIP archive, which is indicative of an attempt to extract files outside of the intended directory. This vulnerability can lead to directory traversal and arbitrary file overwrite.
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) within the file data of an inbound TAR archive, which indicates an attempt to write files outside of the intended directory during extraction. This is a common technique used in Zip Slip attacks to achieve directory traversal and potentially overwrite critical system files or place malicious files in arbitrary locations.
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) in file paths within a TAR archive being transferred to a client, which is indicative of an attacker trying to write files outside of the intended directory.
This rule detects modifications to the NTDS.dit file, which is the Active Directory database. Adversaries often target this file to extract credentials and other sensitive information from domain controllers. Monitoring changes to this file can indicate an attempt at credential dumping or unauthorized access to Active Directory.
Detects potential exploitation of the TARmageddon vulnerability (CVE-2025-62518) by identifying multiple writes to sensitive configuration files by the same process in a short time frame. This behavior can indicate a file overwrite attack where a malicious TAR archive smuggles and extracts a secondary file to hijack build processes or application configurations.
This rule detects suspicious activity related to Windows Server Update Services (WSUS) that could indicate compromise. It correlates three types of events: 1) external network connections to WSUS ports, 2) modifications to the WSUS log file (SoftwareDistribution.log), and 3) suspicious processes (like cmd.exe, powershell.exe, whoami.exe, net.exe) spawned by WSUS-related processes (w3wp.exe, wsusservice.exe) with specific command-line arguments. The rule aims to identify scenarios where an attacker might be interacting with or manipulating a WSUS server.
Detects suspicious modification of the crontab file, which can be used by adversaries for persistence, privilege escalation, or execution of malicious code on Unix-like systems. The rule specifically looks for the 'REPLACE' keyword in cron logs, indicating a crontab entry has been changed.
This rule detects the creation or modification of cron files or files within standard cron directories on Linux systems. Adversaries often abuse the cron utility to establish persistence or schedule malicious tasks for execution at specific times or intervals. Monitoring these file events can help identify unauthorized scheduling of tasks.
Detects modifications to critical Unix shell configuration files. Adversaries may modify these files to establish persistence or elevate privileges by executing malicious commands when a new shell is opened or a user logs in.
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. This can be used by adversaries for persistence, privilege escalation, or defense evasion.
Detects unexpected file modifications by 'dns.exe', which could indicate remote code execution or other exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out modifications to 'dns.log' to reduce false positives.
Detects unusual processes accessing 'desktop.ini' remotely over a network share with write permissions. This activity can be leveraged to alter how Windows Explorer displays a folder's content (e.g., renaming files) without actually changing the files on disk, which can be used for persistence or privilege escalation.
Detects when an uncommon process modifies the Windows Terminal profile settings file, "settings.json". This activity can be indicative of persistence or privilege escalation attempts where an attacker modifies the terminal's startup behavior or injects malicious commands to be executed when the terminal is launched.
This rule identifies modifications to the `/etc/ld.so.preload` file. This file is used by the Linux dynamic linker to specify shared libraries that should be loaded before any other libraries. Attackers can modify this file to inject malicious shared objects into processes, enabling privilege escalation, persistence, or defense evasion by loading arbitrary code.
KQL Query
This rule detects the creation or modification of the `/etc/ld.so.preload` file. This file is used by the dynamic linker (`ld.so`) on Linux systems to specify shared libraries that should be loaded before any other libraries. Adversaries can leverage this mechanism for persistence, privilege escalation, or defense evasion by preloading malicious libraries, effectively hijacking legitimate functions. Refer to `man ld.so` for more details on its functionality.
Detects the modification of common WordPress PHP files to include content characteristic of the UNC5142 CLEARSHORT infection chain. This activity is indicative of a compromised web server. This rule requires a File Integrity Monitoring (FIM) solution or EDR that can inspect the contents of modified files.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
Page 103 of 109