Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects persistence mechanisms involving the modification or creation of Windows Registry Run keys or the placement of executables/shortcuts in the Windows Startup directory. The rule specifically targets binaries located in user-writable directories (Temp, AppData, Downloads) that are either unsigned or lack a signature from trusted publishers, while excluding known legitimate system and third-party application paths.
Detects unauthorized file write operations to Group Policy Object (GPO) startup script paths or suspicious GPO configuration files. This behavior is associated with the TOKYOCORE ransomware, which uses GPO modification as a mechanism for persistence and domain-wide propagation of malicious payloads via startup scripts.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects correlated activity where a browser shortcut (.lnk) file is modified/renamed and, within a 15-minute window on the same host, conhost.exe is spawned with --headless and a cmd.exe/cmd "/c start" command line, indicative of shortcut hijacking used to covertly relaunch a payload such as CountLoader.
Detects the specific combination of persistence mechanisms employed by TOKYOCORE ransomware, which uses redundant Windows autostart techniques including registry run keys, boot execution commands, and startup folder file drops. The rule specifically monitors for masqueraded 'WindowsUpdate' and 'bootexec.bat' naming conventions.
Detects creation of the appscreen.log file under %PROGRAMDATA%\appscreen, an artifact used by GoGRPC backdoor variants to track malware execution activity.
This rule detects unauthorized access or modifications to hardware watchdog device files (/dev/watchdog, /dev/watchdog0, /dev/misc/watchdog, /dev/FTWDT101_watchdog) on Linux systems. Adversaries may manipulate these files to disable the hardware watchdog's automatic reboot functionality, potentially to maintain persistence or to ensure system stability while performing malicious actions without the risk of an unexpected forced reboot.
This rule detects attempts to sabotage or brick Linux systems by monitoring for modifications or overwrites of critical system binaries responsible for reboot, shutdown, and power management, including 'reboot', 'shutdown', 'halt', 'poweroff', 'systemctl', and 'telinit'. It specifically identifies activity associated with the 'ELFOOD' header-corruption marker, a technique linked to the Tengu malware strain which prevents legitimate system reboots to maintain persistence and impede remediation efforts.
Detects potential lateral movement by identifying the creation or modification of a file named 'fsociety.exe' on sensitive Windows administrative shares (ADMIN$ or C$). This behavior is consistent with the TOKYOCORE worm-like threat activity, where malicious binaries are replicated across the network.
Detects unauthorized access or staging operations on the C:\Windows\debug\NetSetup.log file. This activity is often associated with the NightLedger tool, which collects this diagnostic log alongside process listings for potential exfiltration. The rule filters out legitimate system processes that typically interact with this file during domain or workgroup join operations.
Detects unauthorized write or modification access to core Windows boot-related files such as bootmgr, winload.efi, and the BCD store. This activity is indicative of destructive wiper malware attempting to render the operating system unbootable to prevent recovery, a technique observed in the TOKYOCORE wiper campaign.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects the mrmustard stealer's compiled-bytecode artifacts (hw_probe.pyc, .lock_*, .ts_*) dropped in the hidden .tf_cache directory used to evade static source-code review.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects a sequence of events indicative of an MSI rollback attack, where an attacker triggers an MSI installer error, modifies the associated .rbs (rollback script) file in the C:\Config.Msi folder using a non-msiexec process, and subsequently executes the modified script (poc.cmd) to achieve unauthorized code execution with elevated privileges.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects the creation or renaming of .rbf (Rollback File) files within the C:\Config.Msi directory where the previous filename was 'marker.txt'. This behavior is associated with the Windows Installer service (msiexec.exe) and can be leveraged by adversaries to perform file operations or execute arbitrary code during installation processes.
Detects creation or modification of a shell profile (.bashrc/.zshrc/etc.) containing the exact 'tensorflow hardware compatibility check' marker used by the mrmustard stealer to disguise its persistence hook.
Page 50 of 109