Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,427
11,813
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the mrmustard stealer's compiled-bytecode artifacts (hw_probe.pyc, .lock_*, .ts_*) dropped in the hidden .tf_cache directory used to evade static source-code review.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the creation or modification of a file at a specific Launch Agent path commonly used for macOS persistence. Attackers often place property list (.plist) files in /Library/LaunchAgents/ to achieve persistence across system reboots or user logons.
Detects a process creating files named 'README.TXT' or 'README.txt' across three or more distinct directories. This behavior is a common indicator of ransomware activity, where an adversary drops ransom notes in multiple folders to maximize visibility after encrypting files.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects the use of the macOS 'codesign' utility to sign binaries using a self-signed or empty identity certificate. This technique is often used by adversaries to bypass Gatekeeper security controls or to make unsigned malicious binaries appear legitimate.
Detects the installation or referencing of the malicious @injectivelabs/sdk-ts package version 1.20.21. This specific version was identified as containing a credential-stealing backdoor disguised within telemetry code.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects the creation or modification of a specific macOS plist file ('com.apple.crashreporter.helper.plist') within the '/Library/LaunchAgents/' directory, correlated with a file event occurring in '/Library/Caches/' within a one-hour window. This behavior is indicative of an adversary attempting to establish persistence by impersonating a legitimate Apple system process and utilizing cache directories to host malicious payloads.
Detects the use of the Windows 'attrib.exe' utility to hide a file named 'svehost.exe' within the 'AppData\Windows' directory. This behavior is indicative of an adversary attempting to conceal malicious artifacts or persistence mechanisms from the user and basic system exploration tools.
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
Detects unauthorized creation or modification of persistent-state files used by AI agents (e.g., AGENTS.md, MEMORY.md). Such files can be poisoned to manipulate the AI agent's objective knowledge or behavior if the content is sourced from untrusted external inputs like email rather than explicit user instructions.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.
Detects a modified Dockerfile or build script installing netcat and building/pushing a multi-arch image via docker buildx, consistent with backdoored container image creation
Detects the creation or modification of persistence mechanisms (Windows Registry Run/RunOnce keys, Cron jobs, Systemd services, and macOS LaunchAgents/LaunchDaemons) that specifically reference Java executables or .jar files. This pattern is consistent with cross-platform malware such as QuimaRAT attempting to maintain persistence.
Page 52 of 109