Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,427
11,813
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects presence of known-malicious Jscrambler npm supply chain dropper artifact filenames dist/setup.js and dist/intro.js referenced or embedded within scanned content (package contents, tarballs, manifests)
This rule detects when common Windows LOLBins (Living-off-the-Land Binaries) or scripting hosts attempt to read, create, modify, or rename sensitive credential storage files (such as login databases and cookies) associated with popular web browsers like Chrome, Edge, and Firefox. Such behavior is a common indicator of credential theft activity by information-stealing malware.
This rule monitors for the creation or modification of specific files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) that often mimic agent-based collection or configuration files. It specifically identifies when these files are created by processes associated with scheduling mechanisms like 'cron' or 'scheduler', or triggered by a 'heartbeat' event, which is potentially indicative of adversary data collection or staging activity.
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
This rule identifies instances where files are written to the system by processes that lack associated administrative notification or acknowledgment command-line patterns. By joining file-write events with process command-line data, it isolates file creation or write operations performed by potentially unmonitored or non-standard administrative processes, which could indicate suspicious file activity.
Detects new file creation or modification events within the /Library/Caches/ directory of user profiles on macOS. Adversaries may utilize these directories for persistence, staging, or hiding malicious payloads.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
Detects the creation, modification, or renaming of ZIP archive files prefixed with 'zx_' within the macOS crash reporter cache directory. This behavior may indicate an adversary staging crash report data for potential exfiltration.
Detects access, creation, or modification of sensitive browser files (Cookies, Login Data, Local State) associated with Google Chrome or Microsoft Edge. The rule specifically flags when these files are interacted with within standard user directories or when they are copied to known browser backup folders, a common behavior during credential theft or data staging.
Detects Node.js processes generating text or log files containing diagnostic markers related to network activity monitoring, such as 'Network Connection Dump Snapshot' or 'Monitoring active egress sockets'. This behavior is characteristic of custom tool execution used for network discovery and data collection on a host.
This rule detects potential ransomware activity or bulk file manipulation by monitoring for a high volume of file write, rename, or creation events performed by a single process within a one-minute window. It calculates the frequency and variety of unique files touched to identify potentially malicious automated encryption or data destruction behavior.
Detects unauthorized attempts to modify or interact with the macOS Transparency, Consent, and Control (TCC) database. This includes direct file system modifications by non-system processes, sqlite-based manipulation of the TCC database, or the usage of 'tccutil' to reset permissions. These behaviors are often indicative of malware attempting to silently elevate privileges or grant itself Full Disk Access to sensitive user data.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects the creation or execution of the SysAid.exe binary, which is a legitimate Remote Monitoring and Management (RMM) tool. Adversaries may abuse such tools to establish persistence, gain unauthorized remote access, or facilitate further malicious activities within an environment.
Detects unauthorized installation, service creation, and registry modifications associated with the RustDesk remote access tool. The rule monitors for command-line activity indicating the installation of RustDesk as a service, execution of installation scripts, and imports of configurations from non-standard locations, which may indicate the deployment of unauthorized remote access software for C2 purposes.
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
Detects instances where a file named 'config.txt' is created, modified, or renamed. This pattern is commonly used by attackers to stage configuration files, drop payloads, or modify application settings.
Detects a specific exploit pattern where a malicious process triggers Microsoft Defender (MsMpEng.exe) to write a quarantine artifact to a user-controlled directory (such as a TEMP subdirectory), which is then immediately overwritten by an unprivileged process. This behavior indicates an attempt to exploit the Defender quarantine pipeline for unauthorized file manipulation or potential privilege escalation.
Detects instances where the same file (identified by SHA256) with common lure names like 'resume', 'headshot', or 'faceswap' is being created or modified by multiple different users across the environment. This behavior is often indicative of an adversary distributing malicious files or a coordinated effort to access sensitive or tempting filenames, potentially related to social engineering or lateral movement.
Detects execution of Node.js applications that utilize specific Jscrambler obfuscation versions or the presence of these versions in package.json files, which may indicate the use of compromised or unauthorized supply chain dependencies.
Detects file creation, modification, or renaming events within sensitive macOS Application Support directories that mimic core system components such as Finder or Software Update. This behavior is indicative of potential masquerading or persistence techniques where an attacker replaces legitimate application resources with malicious ones.
Page 53 of 109