Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Detects a sequence of suspicious behaviors on a single host within a 1-hour window, indicative of an adversary establishing a foothold and preparing for malicious activity. The pattern involves: 1) System architecture discovery, 2) Downloading files from an external IP address, 3) Changing permissions of files in temporary directories (e.g., /tmp, /var/tmp, /dev/shm), and 4) Executing files directly from those same temporary directories.
This rule detects the creation, modification, or renaming of 'ntdll.dll' within a specific directory path matching the pattern 'ShieldCrash_{GUID}'. This pattern is indicative of potential malicious activity, such as the use of NTFS Alternate Data Streams (ADS) for persistence or execution evasion. The rule explicitly excludes known legitimate system processes that may handle DLL files to minimize noise.
Detects the creation of Object Manager symbolic links that redirect the Windows Defender 'WD_SCAN' object to a loopback UNC share path. This behavior is indicative of a symlink exploitation technique (ShieldCrash/CVE-2026-69414) used to manipulate Windows Defender or associated scan operations by redirecting them to an adversary-controlled or loopback-hosted target.
This rule detects a suspicious sequence of activities indicative of potential lateral movement and credential access. It identifies the execution of PsExec (PSEXESVC.exe) in conjunction with volume shadow copy manipulation (vssadmin, wmic, or diskshadow to create or delete shadow copies) within a 30-minute window. It further correlates this activity with potential lateral movement commands (e.g., net.exe, query.exe, nslookup.exe) to assess the severity of the incident.
This rule detects a suspicious sequence of activities indicative of potential lateral movement and credential access. It identifies the execution of PsExec (PSEXESVC.exe) in conjunction with volume shadow copy manipulation (vssadmin, wmic, or diskshadow to create or delete shadow copies) within a 30-minute window. It further correlates this activity with potential lateral movement commands (e.g., net.exe, query.exe, nslookup.exe) to assess the severity of the incident.
Detects suspected exploitation of CVE-2026-81963, an Elevation of Privilege vulnerability in the Windows Update stack. The rule monitors for the creation of reparse points, junctions, or symbolic links within update staging paths by Windows Update processes, followed by either the spawning of suspicious child processes or unauthorized file writes/renames outside of expected directories, which are indicative of a privileged link-following exploit.
Detects instances where node, npm, or bun package installation processes modify the Claude AI settings.json file. This could indicate potential supply chain compromise or unauthorized configuration changes to the Claude application environment via malicious packages or scripts.
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
Detects SSH persistence planted during the Red Heron campaign: authorized_keys file writes under a .ssh folder, correlated with process command lines referencing authorized_keys and the operator's observed key comment naming pattern (backdoor / root-shell).
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Detects high-frequency file creation, modification, or renaming activity involving files with the specific '.df_win' extension, likely indicative of mass encryption activity or automated ransomware behavior. The rule excludes known backup and security software processes to reduce noise.
Detects unauthorized write, modification, or rename operations performed on the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) by processes that are not typically authorized for such activity, such as standard system processes (svchost, services, etc.).
Page 32 of 109