Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects instances where a process other than msiexec.exe performs directory change operations (ReadDirectoryChangesW) within the 'C:\Config.Msi' folder. This path is often used by the Windows Installer, and unauthorized access to this directory can indicate suspicious activity related to DLL sideloading or persistence mechanisms.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects suspicious modifications to Windows Boot Configuration Data (BCD) using bcdedit.exe by unsigned or non-standard processes outside defined maintenance windows. This behavior is associated with the Dolphin X malware's bootkit persistence module, designed to gain control before the operating system initializes.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the creation or modification of Windows Registry Run keys that point to OCX (ActiveX Control) files located within user-writable AppData directories. This behavior is associated with the persistence mechanisms of various malware families, including TinyEgg, ChonkyChicken, and ChromEggscalator, which often utilize the 'WinComCtl' value name to maintain execution across system reboots.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects file creation, modification, or renaming operations involving .rbs or .rbf files within the 'C:\Config.Msi' directory when the process performing the action is not 'msiexec.exe'. Adversaries may attempt to manipulate MSI rollback or installation files to achieve persistence or execute arbitrary code during the installation process.
This rule detects file-level activity associated with the known malicious version of the ModHeader browser extension (Extension ID: idgpnmonknjnojddfkpgkljpfnnfcklj). It flags the presence of specific indexedDB LevelDB files and temporary directories that are characteristic of the malicious update, which was used for unauthorized data access and browser-based persistence.
Detects the use of the bindutil utility to create a link or redirection for a DLL path. This behavior is often associated with modifying search paths or redirecting DLL dependencies in container or virtualization environments. The rule excludes common, legitimate system and container processes that use bindutil for path management.
Detects unauthorized processes (non-msiexec.exe) modifying registry keys related to TempPackages alongside simultaneous modification or interaction with .rbs or .rbf files located within the C:\Config.Msi directory. This behavior is indicative of potential MSI installer hijacking or tampering attempts where an adversary attempts to bypass standard installer execution paths.
This rule detects when a web server process (such as apache, httpd, or php-fpm) modifies or creates a new PHP file within common WordPress directories (plugins or themes). This behavior is often indicative of an attacker attempting to plant a web shell to gain or maintain persistent access to a compromised server.
This rule detects various common methods of achieving persistence on Linux and macOS systems. It monitors file system changes to systemd unit files and macOS LaunchAgent plist files, as well as the execution of commands related to managing systemd services and user crontab entries.
This rule monitors for processes, file names, or command lines that contain the string 'telepuz', which is indicative of a specific malware or malicious toolset. It alerts on any occurrence within process image names, process command lines, or file paths.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects the creation or modification of a file named 'g11.sys'. This filename is often associated with the deployment of malicious or vulnerable drivers used for kernel-mode exploitation, such as Bring Your Own Vulnerable Driver (BYOVD) attacks or rootkit activity.
Detects modifications to Windows Defender exclusion settings by monitoring both PowerShell command lines containing 'Set-MpPreference' with 'ExclusionPath' and direct Registry modifications to the Defender exclusions key. Threat actors commonly use these techniques to bypass security scanning for malicious files or tools placed in the 'C:\ProgramData' directory.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
This rule detects file creation, renaming, or modification events targeting files associated with cryptocurrency wallets, such as wallet.dat or files containing the string 'keystore'. Accessing these files is a common technique used by malware or malicious actors to steal cryptocurrency credentials and private keys.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Page 51 of 109