Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects a suspicious sequence of activities that potentially indicates an attempt to exploit Common Log File System (CLFS) vulnerabilities or manipulate cloud filter drivers for privilege escalation. The rule monitors for a correlation between Registry modifications involving Cloud Filter settings (HKLM\SYSTEM\CurrentControlSet\Services\CldFlt) and the creation or modification of specific CLFS-related files (.blf, .blf2, .regtrans-ms) occurring within a 10-minute window, with an optional check for symbolic link manipulation (NtCreateSymbolicLinkObject).
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
This rule detects potential data exfiltration or verification behavior by correlating a file write event in a temporary directory (/tmp/) with a subsequent 'cat' command execution reading that same file within a 10-minute window. This behavioral pattern is often associated with C2 agents staging data for retrieval.
Detects modifications to the Transparency, Consent, and Control (TCC) database on macOS. The rule categorizes activity based on the file path (system-wide or user-specific) and the user account performing the modification, identifying potentially unauthorized changes to application privacy permissions.
Detects a non-system process causing creation of CldFlt0.etl under C:\Windows\System32\LogFiles\CloudFiles\.
This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot().
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.
This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot().
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.
Detects file creation, write, or rename operations to specific paths known to be used in exploitation of CVE-2026-63077.
This rule monitors for two critical firmware-related conditions: detected non-compliance with secure boot, UEFI, or TPM configuration standards via Microsoft Defender TVM, and explicit firmware or boot configuration change events reported by device telemetry. It is designed to identify potential tampering or misconfigurations that could facilitate bootkits or other pre-OS persistence mechanisms.
This rule monitors for two critical firmware-related conditions: detected non-compliance with secure boot, UEFI, or TPM configuration standards via Microsoft Defender TVM, and explicit firmware or boot configuration change events reported by device telemetry. It is designed to identify potential tampering or misconfigurations that could facilitate bootkits or other pre-OS persistence mechanisms.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
This rule detects potential attempts to bypass macOS Gatekeeper security checks by identifying the removal of the 'com.apple.quarantine' extended attribute using the 'xattr' utility, or by changing file permissions using 'chmod' on files marked with the 'com.apple.verified' attribute. Adversaries use these techniques to ensure malicious or untrusted binaries execute without user prompts or security warnings.
Detects modification of sensitive Active Directory LDAP attributes (msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, scriptPath, msTSInitialProgram, msDS-KeyCredentialLink) via Windows Security EventCode 5136, and correlates the initiating session back to its originating logon (EventCode 4624) to surface the actor's SID, domain, source IP, and logon host. These attributes are commonly abused for Kerberos delegation abuse (constrained/resource-based constrained delegation), logon-script/Terminal-Services persistence, and Shadow Credentials (msDS-KeyCredentialLink) attacks. Includes anchor fields (initiator SID, domain controller, distinct-attribute count, operation correlation ID) to support precise, low-blast-radius tuning instead of broad exclusions.
This rule detects the creation or modification of files within the Google Chrome browser extensions directory by processes other than legitimate Chrome-related binaries (chrome.exe, GoogleUpdate.exe). This activity is highly indicative of malicious browser extension sideloading or persistence, where an adversary attempts to install a rogue extension to achieve goals such as credential theft, session hijacking, or command-and-control communication.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This rule detects the creation or modification of files within the Google Chrome browser extensions directory by processes other than legitimate Chrome-related binaries (chrome.exe, GoogleUpdate.exe). This activity is highly indicative of malicious browser extension sideloading or persistence, where an adversary attempts to install a rogue extension to achieve goals such as credential theft, session hijacking, or command-and-control communication.
This rule detects the creation of diagnostic crash-dump files within known engineering log directories (e.g., slog, engineermode, vendor/log) within 30 minutes of EngineerModeActivity or YLog execution. This pattern is indicative of potential forensic evidence from an induced modem crash, consistent with known exploit chains targeting specific mobile device vulnerabilities.
This rule detects the potential replacement of legitimate cryptocurrency wallet applications (Ledger, Trezor, Exodus) by monitoring for the download of zip archives from suspicious paths containing 'zxc' using curl, followed by the creation or modification of files within known wallet application directories. This activity is indicative of a trojanized application delivery mechanism, often associated with info-stealer campaigns.
This rule detects potential persistence attempts on macOS by monitoring 'launchctl' commands used to bootstrap LaunchAgents or modify configuration files related to Apple's software update mechanisms. It also flags file events involving the 'com.apple.softwareupdate' cache directory, which could indicate an adversary attempting to stage or replace update-related files.
Detects the creation and configuration of suspicious LaunchAgent and LaunchDaemon plist files on macOS. It identifies files masquerading as legitimate system components (e.g., com.finder.helper, .mainhelper, .agent) or exhibiting common patterns of persistent agent names (random 10+ character names). It also monitors for the use of 'launchctl load' to activate these suspicious configuration files.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This rule detects unauthorized or suspicious file access, modification, or creation events targeting sensitive web browser data files, including login credentials, saved passwords, and browser cookies. These files are prime targets for information-stealing malware attempting to harvest sessions or authentication data.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Page 48 of 109