Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.
This rule monitors for file creation or modification events related to the Admin Menu Editor Pro WordPress plugin, specifically looking for indicators of specific versions (2.35, 2.36) or file naming conventions. It also alerts on network communication to the plugin's domain, which could indicate a compromise or the use of an unauthorized or modified plugin version that may be associated with known vulnerabilities.
Detects the presence of PHP web shell code within the Admin Menu Editor Pro WordPress plugin directory. This rule targets indicators of a supply chain compromise where a legitimate plugin update is backdoored to include malicious PHP code designed for remote command execution via HTTP requests.
Detects instances where a process running as 'root' modifies files within an Acronis-related directory. This specifically alerts when the modifying process is not identified as a known, authorized Acronis backup service, potentially indicating unauthorized tampering with backup archives or configuration files.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
This rule detects unauthorized processes modifying the 'Secure Preferences' configuration file in Google Chrome or Microsoft Edge browser data directories. This activity often indicates an attempt by malicious software to hijack browser settings, such as forcing extensions or modifying security policies, which is a common precursor to credential theft or persistent malicious access.
This rule detects unauthorized processes modifying the 'Secure Preferences' configuration file in Google Chrome or Microsoft Edge browser data directories. This activity often indicates an attempt by malicious software to hijack browser settings, such as forcing extensions or modifying security policies, which is a common precursor to credential theft or persistent malicious access.
This rule detects unauthorized processes modifying the 'Secure Preferences' configuration file in Google Chrome or Microsoft Edge browser data directories. This activity often indicates an attempt by malicious software to hijack browser settings, such as forcing extensions or modifying security policies, which is a common precursor to credential theft or persistent malicious access.
Detects the creation or renaming of specific files ('windowSysUpdates.txt' or 'GymTraniningShedule.exe') within the user's Local AppData directory or its 'SystemFolder32'/'System Folder32' subdirectories. This behavior is indicative of potential malicious activity, such as staged malware persistence or disguised payloads.
Detects execution of shell commands by cmd.exe in conjunction with the creation or modification of 'command.txt' or 'results.txt' files, which are indicative of the RUSTYSHADE backdoor's C2 synchronization behavior.
Detects the historical HPlus HTS fraud infrastructure chain. The rule monitors for the reading of a configuration file named 'config.Ini', followed by an outbound FTP connection (port 21), and the subsequent launch of an executable, which is indicative of a Quasar RAT deployment sequence.
This rule detects potential ransomware activity by monitoring for specific file naming patterns associated with known ransom notes (.krsid, README_KRSID.Txt) and the execution of suspicious processes (HTSPnew.Exe, UBPUpdater.exe).
Detects a suspicious correlation where a host reports a confirmed exploit attempt followed by a high volume of file modifications (encryption behavior) within a single hour. This short dwell time is a strong indicator of automated or AI-orchestrated ransomware deployments.
Detects unauthorized file operations (creation, modification, or renaming) against the Windows hosts file located at C:\Windows\System32\drivers\etc\hosts. This is a common technique used by attackers to redirect network traffic, hijack domains, or disrupt communications to security services. The rule excludes common system processes known to perform legitimate maintenance on this file.
Page 28 of 109