Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,427
11,813
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects potential keylogging activity associated with Millenium RAT, characterized by the creation of log files with randomized 8-12 character filenames and folder names within the %APPDATA%\Roaming directory.
Detects the creation of a 'BackupFiles' directory and the subsequent copying of sensitive browser artifacts (e.g., Login Data, Web Data, Local Storage) within Chrome or Edge user data paths. This activity is indicative of credential and session theft staging, specifically associated with the ToddyCat group's Umbrij malware preparation for browser exploitation.
Detects the creation or modification of a file named 'maisum.dat', which has been associated with malicious activity and malware behavior.
Detects potential abuse of Active Directory Certificate Services (AD CS) by monitoring for suspicious command-line activity from 'certreq.exe' and 'certutil.exe' associated with certificate enrollment, submission, or management. It also identifies the staging of certificate-related files (.pem, .pfx, .p12, .crt, .cer, .key) in common user directories.
Detects post-exploitation persistence activity following a DirtyClone (CVE-2026-43503) privilege escalation. The rule monitors for the creation of local user accounts via binaries like useradd and usermod, as well as unauthorized modifications to sensitive Linux configuration files such as /etc/sudoers or /etc/shadow, specifically when executed with root-level privileges.
Detects unauthorized or suspicious modifications to critical Linux configuration directories (e.g., cron, rc, init, ipsec) or specific application-related paths by processes not typically associated with system management or package maintenance. The rule further elevates risk when specific indicators like LD_PRELOAD, LD_LIBRARY_PATH, or known malicious string artifacts are present in the command line or file path.
Detects anomalous activity associated with the RoguePlanet (CVE-2026-50656) exploit. The rule identifies suspicious file operations by MsMpEng.exe within temporary staging directories (RP_<UUID>), execution of non-Microsoft signed binaries from these staging paths, and unexpected file activity involving 'wdtest_temp' paths, which are indicative of an NTFS junction swap exploit sequence.
Detects signs of the VerdantBamboo threat actor's BRICKSTORM/PLENET campaign, specifically targeting Linux-based edge appliances like pfSense and Synology NAS. The rule monitors for sudo abuse by specific service accounts (e.g., egnyteservice, www-data) attempting to leverage NOPASSWD sudo privileges for the 'tee' utility to write malicious content into sensitive system files (e.g., /usr/sbin/, /etc/cron.d/, /etc/sudoers). Additionally, it identifies unauthorized sudo enumeration commands that may indicate early-stage reconnaissance or persistence efforts.
Detects the execution of QEMU processes, the presence of suspicious virtual disk files (e.g., .qcow2, .db) in unexpected locations, and the installation of Virtio drivers. These patterns may indicate an adversary is deploying hidden virtual machines to bypass host-based security controls.
This rule detects potential keylogging activity by identifying either low-level Windows keyboard hooks initiated by suspicious processes or the creation of suspicious log files in user-writable directories by unsigned processes. It filters out common, trusted browser processes and signed Microsoft binaries to reduce noise.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
Detects indicators of persistence via dynamic linker hijacking on Linux systems, specifically looking for the creation or usage of .libcache.so, modifications to /etc/ld.so.preload, hidden shell profile droppers, or node process execution utilizing LD_PRELOAD variables.
This rule detects the creation or modification of files that contain common certificate-related keywords such as 'crl', 'certificate', or 'pem'. This activity could indicate the deployment of new certificates, which might be legitimate or malicious, such as for establishing command and control, code signing, or evading detection.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
Detects the modification or creation of Pluggable Authentication Module (PAM) files or shared libraries in Linux environments. This technique is often used to establish persistence or intercept authentication credentials by replacing legitimate modules like pam_unix.so with malicious counterparts.
This rule detects potentially suspicious modifications to Nginx configuration files or the usage of FastCGI directives such as fcgiwrap, fastcgi_pass, and proxy_pass. It specifically monitors for actions related to configuration changes (write, modify, create) or the establishment of backend communication via FastCGI parameters, which may indicate an attempt to gain remote code execution or persistence on a web server.
Detects execution and network activity associated with the NUKESPED (ThreatNeedle) backdoor component identified as 'zlrenu8.exe'. The rule monitors for outbound network connections to Fastly CDN infrastructure, which is frequently used by this actor for command-and-control or data exfiltration, as well as file operations within the 'ProgramData' directory indicative of staging activity.
Detects modifications to Windows Registry keys responsible for the 'open' command handler associated with 'exefile'. Adversaries often modify these registry keys to achieve persistence or execute malicious code whenever an executable is opened, by injecting commands or replacing the default handler.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects various techniques used by an attacker to escape a container environment or gain unauthorized access to host-level resources. This includes the execution of namespace manipulation tools (nsenter, unshare, chroot), unauthorized access to the docker.sock Unix socket, mounting of host filesystems from within a container, and direct attempts to access the host's /proc/1 namespace files.
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
Page 60 of 109