Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects processes accessing or modifying Microsoft Outlook data files (.pst or .ost), which may indicate an attempt to collect, stage, or export sensitive email data from a local system.
Detects the SMB share discovery pattern associated with the DragonForce ransomware, where the system enumerates network shares (excluding ADMIN$) followed by unauthorized bulk write operations to these shares, indicating potential lateral movement and file encryption.
Detects the installation or update of browser extensions that possess both 'declarativeNetRequest' and 'content_scripts' permissions, while also requesting host permissions for major AI assistant or trusted vendor domains (e.g., google.com, gemini.google.com, copilot.microsoft.com, claude.ai). This specific combination of permissions is characteristic of the BragJack attack chain used to redirect network traffic and hijack AI browser agent sessions.
Detects access, reading, or modification of sensitive credential files (such as KeePass databases, VPN profiles, private SSH keys, and certificates) by a process. This behavior is often associated with pre-encryption staging for data exfiltration during ransomware attacks.
Detects the creation, renaming, or modification of a file named 'FitnessMonitor.exe' within the Windows Startup folder. This behavior is indicative of an attempt to establish persistence by ensuring the executable runs automatically upon user login.
Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.
Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Detects a suspicious sequence of events where a user or process removes the 'com.apple.quarantine' extended attribute from a file bundle using 'xattr -cr', immediately followed by ad-hoc code signing the same file using 'codesign -s -'. This pattern is commonly used to bypass macOS Gatekeeper security controls by stripping quarantine flags and re-signing the application to allow execution of untrusted or modified code.
Detects Python compiled bytecode (.pyc) files that have been renamed to .cat, a common Windows Security Catalog extension. This is a masquerading technique often used by backdoors to evade detection and facilitate malicious loader execution.
This rule detects the addition of Microsoft Defender exclusions via PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry key modifications, occurring within two hours of a new autorun persistence entry being created on the same device. This behavior is indicative of a persistence-then-evasion sequence often used to ensure malicious tools remain undetected.
Detects unauthorized modifications to the InprocServer32 registry key for the specific CLSID {2155fee3-2419-4373-b102-6843707eb41f}, a technique used by malware to achieve persistence by hijacking COM object instantiation to load a malicious DLL.
This rule detects potential exploitation attempts targeting VLC media player, specifically focusing on the CVE-2026-56711 integer overflow vulnerability. The rule identifies instances where VLC processes a PNG file originating from untrusted locations (such as Downloads, Temp, or removable media) shortly after that file was created or modified on the host.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects modifications or creation of GitHub Actions workflow files containing references to Model Context Protocol (MCP) extensions or AI-related build tools. This monitors for indicators of potential software supply chain tampering, where an adversary injects unauthorized CI/CD pipeline steps for malicious execution.
Detects suspicious Git activity or file modifications within the plugin directories of various AI coding assistants (such as Claude, Codex, Copilot, or Gemini). This may indicate an attempt to inject malicious code or persistence mechanisms into the local environment via untrusted plugins.
This rule monitors for suspicious activity originating from the WinRM service host (wsmprovhost.exe). It detects when command shells (cmd.exe, powershell.exe) are spawned by WinRM with known malicious command-line arguments (e.g., Evil-WinRM tools), monitors for the creation of potentially malicious configuration files (e.g., config.toml), and identifies established network connections to common WinRM ports (5985/5986) to detect unauthorized remote sessions.
Page 21 of 109