Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
Detects a silent MSI installation (msiexec.exe with /i, /quiet, and /qn) where the target MSI file was created or written by the same causality chain on the same host within the preceding 60 minutes, consistent with CountLoader/DOUBLECUP payload staging and silent deployment behavior.
This rule detects the use of the Certutil.exe utility with flags commonly associated with adversary techniques such as downloading files, decoding malicious payloads, or manipulating the Windows Certificate Store.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Detects unauthorized access, creation, modification, or deletion of the 'passkey_enclave_state' file within the Google Chrome user data directory by processes other than 'chrome.exe'. This file contains sensitive cryptographic material related to Chrome's synced passkey cloud authenticator, and non-browser process interaction with it is indicative of potential credential theft or passkey exfiltration (e.g., 'Golden/Silver Pass-ta-key' attacks).
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects deletion, modification, or renaming of the Chrome 'passkey_enclave_state' file by a process other than Chrome. This file contains sensitive wrapped identity, User Verification (UV) private keys, and security domain secrets. Unauthorized access or deletion of this file is indicative of an attempt to force Chrome to re-onboard the device, which may expose key material during the re-registration flow.
Detects unauthorized modifications to the core npm CLI entry point file (cli.js). Adversaries may modify this file to inject malicious code, achieving persistence or executing unauthorized commands whenever the npm tool is invoked.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Detects the HeptaX keylogger by identifying a specific sequence of suspicious process behaviors: installation of WH_KEYBOARD_LL or WH_MOUSE_LL hooks, creation of a specific "Microsoft_SysInternal_logger-v2.0" mutex, elevating the process priority class to high or realtime, and writing log files to a directory masquerading as a OneDrive folder within ProgramData.
Detects file creation, modification, or rename activity targeting known directory paths and files used by the AMOS (Atomic macOS Stealer) to stage exfiltrated credentials, cryptocurrency wallets, and browser data. It identifies staging activity by looking for patterns associated with the stealer's data-collection routines.
Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.
Detects potential post-exploitation activity originating from the SharePoint worker process (w3wp.exe). The rule monitors for three primary indicators: w3wp.exe spawning command interpreters (cmd.exe or powershell.exe), unauthorized file modifications or creations within SharePoint web directories, and outbound network connections to public IP addresses initiated by w3wp.exe, which may indicate payload delivery or C2 communication. (CVE-2026-50522)
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.
Detects anomalous, high-volume file access (creation, modification, or renaming) targeting sensitive extensions (e.g., .key, .pem, .pfx) within document directories by unsigned processes. It also detects similar high-volume file access behavior that occurs immediately following the mounting of a removable USB device, consistent with CornFlake RAT data exfiltration patterns.
Detects post-exploitation persistence and anti-forensic activity associated with the RufRoot/CVE-2026-59726 vulnerability. The rule identifies the creation of unauthorized .js files within application directories, the modification of 'index.js' followed by a SIGKILL to process ID 1 to force a container restart, and attempts to clear bash command history to hide malicious footprints.
Detects HollowMare variants (OneZip/CrystalPDF/PowerDoc) that terminate a running Chrome or Firefox process immediately before overwriting a browser profile configuration file (Preferences, Secure Preferences, prefs.js) with a C2-supplied version to hijack the default search engine.
Page 49 of 109