Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects attempts to remove the 'com.apple.quarantine' extended attribute from files on macOS using the 'xattr -d' command. This is a common technique used to bypass Gatekeeper's execution restrictions on downloaded files, allowing untrusted applications to run without security warnings.
Detects attempts to remove the 'com.apple.quarantine' extended attribute from files on macOS using the 'xattr -d' command. This is a common technique used to bypass Gatekeeper's execution restrictions on downloaded files, allowing untrusted applications to run without security warnings.
This rule detects the creation, modification, or renaming of a file named '/tmp/helper' within a one-day window of a 'curl' or 'wget' command-line execution that references this specific path. This pattern is commonly indicative of an adversary downloading and staging malicious tools or payloads in a temporary directory on Linux systems.
Detects creation or modification of the Faronics Deploy 'ScriptRunner.log' file. This artifact records script execution history and download URLs used by the Faronics Deploy management platform, which can be abused by adversaries for persistence or remote command execution.
Detects creation or modification of the Faronics Deploy 'ScriptRunner.log' file. This artifact records script execution history and download URLs used by the Faronics Deploy management platform, which can be abused by adversaries for persistence or remote command execution.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects the creation, modification, or renaming of files within directories associated with GVFS (GNOME Virtual File System) or files masquerading as GVFS components. Adversaries often use these paths and file names to stage or hide malicious tools and persistence mechanisms on Linux systems.
This rule detects when PowerShell is used to create or modify a LNK file within the Windows Startup folder. Adversaries often place malicious LNK files in this directory to achieve persistence, ensuring their code executes upon user login.
Detects the suspicious execution of a file named 'Windowsupdate.exe' located in 'AppData\Local' that is invoked via a command containing 'copy' and '/b'. This behavior is indicative of an attacker attempting to copy or stitch binary files using a masqueraded system process name to evade detection.
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.
This rule detects potentially malicious modifications to PostgreSQL configuration files or the creation of new library files (.so or .dll) by the PostgreSQL service process. It also flags when the PostgreSQL service process is initiated with command-line arguments referencing 'shared_preload_libraries', which can be abused to load arbitrary code or malicious extensions into the database engine.
This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.
Detects malicious markdown files (SKILL.md) that impersonate agent instruction files. These files contain hidden-content constructs (like CSS display:none, HTML comments, or invisible Unicode characters) combined with common command execution patterns (like curl, wget, or PowerShell encoded commands), characteristic of infostealer campaigns targeting AI agent platforms.
CVE-2026-65400 affects the macOS Screen Sharing service and can allow an attacker on the network to authenticate without valid credentials. Huntress' research goes further, describing the pre-authentication path and opportunities to obtain root-level file access and ultimately code execution. First thing first: patch. Update affected devices to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Apple released these versions on August 6 to address CVE-2026-65400. If patching is not immediately possible, disable Screen Sharing. After patching, we still need to answer the hunter's question: was any of this activity already happening before the update? The KQL below hunts across Microsoft Defender XDR telemetry for activity around the observed attack path: Screen Sharing file activity, SSH sessions, privileged file writes, LaunchDaemon persistence, process masquerading, Packet Filter changes, XMRig artefacts and related network activity. One process particularly worth reviewing is SSFileCopyReceiver / SSFileCopySender. Huntress notes that these are privileged Screen Sharing helpers, and their research highlights root-context activity and filesystem operations as useful hunting opportunities.
Detects instances where processes other than the primary web browsers (Chrome, Brave, Firefox) create, rename, or modify sensitive browser data files like 'Cookies' or 'Login Data'. This behavior is indicative of credential theft or data exfiltration attempts where an adversary is accessing browser-stored information.
The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
Detects execution patterns associated with the Apple macOS Stealer (AMOS) ClickFix malware, specifically the removal of quarantine attributes and permission modification for a staged 'helper' executable within the /tmp directory, followed by the execution of that binary.
Detects macOS persistence mechanism involving the registration of a disguised LaunchAgent via 'launchctl bootstrap', storing payloads in paths masquerading as system cache directories, and the subsequent removal of the 'com.apple.quarantine' extended attribute using 'xattr' to bypass Gatekeeper execution restrictions.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
Page 46 of 109