Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects post-compromise persistence techniques, including crontab modifications, SSH authorized_keys updates, and systemd service creation, when performed by child processes of AI agentic tools like Claude, Node.js, or Python. This activity suggests malicious persistence establishment following an indirect prompt injection or supply-chain compromise of the AI agent environment.
Detects unauthorized processes (non-browser related) attempting to modify Chrome/Chromium user profile preference files or sensitive browser registry keys related to search providers and security MACs. This activity is often associated with browser hijacking, malware persistence, or unauthorized manipulation of browser settings.
Detects activity associated with the 'MiniBrowse.exe' process, which exhibits behaviors characteristic of unauthorized browser credential and cookie harvesting. This includes targeting browser 'Login Data' files, accessing cookies, attempting to interact with legitimate browser processes (chrome.exe, msedge.exe) via cross-process operations, and writing logs to 'edgeLog.txt'.
This rule monitors Sysmon Event ID 11 (FileCreate) to detect high-volume file creation activity across multiple unique directories. By filtering out common file types, it identifies potential signs of mass file modification, staging for exfiltration, or malicious encryption characteristic of ransomware or data destructive operations.
Detects the creation or modification of known malicious files associated with the StegoAd (DarkSpectre) campaign. The rule monitors popular Chromium-based browsers (Chrome, Edge, Brave) dropping specific files like 'msn.woff' (malicious font), WebP containers (steganography), and 'setting.conf' (C2 configuration) into browser-related directories such as AppData or extension storage folders.
Detects indicators of the DirtyClone (CVE-2026-43503) Linux kernel local privilege escalation exploit. The rule identifies the execution or compilation of the PoC binary, the specific su invocation used for shell spawning by the exploit, and subsequent post-exploitation actions including modifying sensitive files (/etc/passwd, /etc/sudoers) and creating new local accounts with sudo privileges.
Detects anomalous activities associated with the CitrixBleed2 campaign where the ScreenConnect remote access tool is used to deploy or execute QEMU virtual machine artifacts. The rule monitors for the spawning of virtualization binaries (e.g., qemu-system-x86_64) via the ScreenConnect service, the dropping of QEMU-related files into ScreenConnect directories, and the suspicious creation of local administrator accounts (CtxAppVCOMService).
Detects suspicious command-line patterns on Linux systems commonly associated with post-exploitation activity, including the establishment of reverse shells, encoded payload delivery via DNS, and manual modifications to crontab or SSH authorized_keys for persistence.
Detects techniques used by adversaries to hide files, directories, or modify access permissions on Windows systems. This includes the use of 'attrib.exe' to set the hidden attribute, PowerShell cmdlets to set file attributes, 'icacls' to modify or deny permissions, and the creation of hidden Unix-style dot-prefixed files within common Windows user directories.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
Detects evidence of arbitrary command execution originating from OpenVPN Connect, potentially via an echoed script payload that executes commands upon disconnect, bypassing security controls. The rule identifies suspicious child processes spawned by OpenVPNConnect.exe and detects the creation of a known proof-of-concept marker file.
Detects artifacts and network activity associated with a malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that uses declarativeNetRequest rules to redirect browser search traffic to a typosquatted domain (perplexity-ai.online). The rule correlates file creation, registry modifications, and outbound network connections to the malicious domain from common web browsers.
Detects instances where a user account modifies sensitive payroll or banking information (e.g., direct deposit details) shortly after performing a sign-in from an unmanaged device or suspicious context. This behavior is indicative of an Adversary-in-the-Middle (AiTM) token replay attack targeting HR SaaS applications like Workday to perform financial fraud.
Detects the presence of malicious Chromium browser extension artifacts related to the 'Search for perplexity ai' extension. This extension abuses Manifest V3 declarativeNetRequest permissions (such as declarativeNetRequestFeedback and declarativeNetRequestWithHostAccess) to intercept and redirect network requests to the attacker-controlled domain 'perplexity-ai.online'. The rule specifically identifies the extension's rule resource files (e.g., perplexity-rules.json) and specific file paths associated with the extension ID.
This rule detects various Windows persistence and hijacking techniques by monitoring registry activity. Specifically, it identifies the manipulation of IFEO (Image File Execution Options) Debugger or GlobalFlag keys, HKCU COM class hijacking through InProcServer32 or LocalServer32, and the AppCertDlls registry value, which can be used to inject malicious code into processes.
Detects malicious activity related to the 'RoguePlanet' exploit (referencing CVE-2026-50656) which involves manipulating NTFS junctions to redirect system file operations. The rule monitors for specific staging directory patterns (RP_<UUID>), the creation of named pipes associated with RoguePlanet, and the execution of suspicious binaries or staging of files in system paths.
Detects BQTLock ransomware activity where the BQT.exe process accesses browser credential stores (Chrome, Firefox, Opera) and writes the extracted data to a temporary file at C:\Windows\Temp\bqt_passwords.txt.
This rule detects the installation and configuration of the OpenSSH Server feature on Windows endpoints. It monitors for the use of Add-WindowsCapability to install the feature, administrative commands (net.exe, sc.exe) used to manage the sshd service, and the creation or modification of authorized_keys files, which are often used to maintain persistent, passwordless access to the system.
Detects unauthorized file write or rename operations targeting core OpenSSH binary and library paths, excluding known package manager activities. This behavior is indicative of an adversary replacing legitimate system binaries to create a trojanized version of OpenSSH, as observed in the Velvet Ant 'Operation Highland' campaign, used to harvest credentials and log SSH sessions.
Detects attempts to exploit the SystemInformer (formerly Process Hacker) service (phsvc) for local privilege escalation. The rule monitors for abnormal process spawning by rundll32.exe, the presence of specific PoC artifacts like 'phsvc_rundll_poc.dll', 'systeminformer_phsvc_poc.txt', or command-line arguments containing 'SYSTEMINFORMER_PHSVC_POC', and loading of DLLs from user-writable temporary directories.
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
Page 55 of 109