Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,427
11,813
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects file creation or write operations within protected macOS System 'Application Support' directories that mimic legitimate Finder or system component filenames. This behavior is indicative of an attacker attempting to masquerade malicious files or persistence mechanisms as core macOS system utilities.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
Detects processes that install a low-level keyboard hook (WH_KEYBOARD_LL) and are simultaneously involved in suspicious activity, such as network connections to non-private IP addresses and file writes to typical temporary directories (e.g., C:\Windows\Temp, C:\Users\Public). This behavior is characteristic of keylogging activity and subsequent data exfiltration or staging.
This rule detects activities associated with VILE ransomware, focusing on unsigned Go-based binaries. It flags processes performing cross-process operations, creating specific file artifacts (e.g., vile_deadlines.json, vile_Decryptor), or invoking direct NT system calls such as NtCreateWaitCompletionPacket to evade EDR hooks.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects the use of the attrib.exe utility to modify file attributes by applying the hidden (+h), system (+s), and read-only (+r) flags simultaneously to files located within the ProgramData directory. This behavior is a common technique used by malware to hide artifacts from users and evade basic detection while attempting to prevent accidental deletion or modification.
Detects evidence of the MYRA Linux RAT attempting to establish persistence via the LD_PRELOAD environment variable mechanism. The rule monitors for the creation or modification of specific malicious library files (libcache.so, .sh.local) and the execution of processes utilizing LD_PRELOAD to hijack dynamic linker operations.
This rule detects persistence mechanisms and fileless execution patterns commonly associated with the MYRA malware family on Linux systems. It specifically monitors for malicious cron job creation, LD_PRELOAD library manipulation, unauthorized shell profile modifications, and memfd-based execution spawned from Node.js or npm processes.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
Detects the execution of ServiceModelReg.exe followed by suspicious network or file system activity. ServiceModelReg.exe is a legitimate Windows utility that may be abused by adversaries for process hollowing or masquerading to evade defenses.
Detects the silent installation of Opera GX mods by correlating the rapid arrival of a .crx file followed by the creation of a manifest.json file within the Opera GX mods profile directory. This pattern indicates potential exploitation of the silent installation pipeline where an extension is added without explicit user confirmation prompts.
This rule detects potential web shell activity on ColdFusion or IIS servers by monitoring for the creation of known malicious file names typically associated with web shells and the execution of suspicious child processes (e.g., cmd.exe, whoami.exe, powershell.exe) by common web server worker processes (w3wp.exe, coldfusion.exe, jrun.exe). It also identifies suspicious command-line patterns referencing the web root directory.
Detects a suspected 5-step exploit sequence targeting CVE-2026-43503 on Linux systems. The rule monitors for unprivileged user and network namespace creation, followed by XFRM state modification, kernel module loading, raw ESP socket creation, and finally writing to /proc/[pid]/mem to facilitate page-cache corruption and bypass Copy-on-Write (CoW) protections.
Detects modifications to the AdminSDHolder object in Active Directory via Windows Security Event ID 5136. The AdminSDHolder object maintains the security permissions for all objects protected by the AdminSDHolder process. Adversaries often modify this object to establish persistence and gain unauthorized access to highly privileged accounts within the domain.
Detects suspicious execution of Node.js processes initiated by VS Code (or Cursor) that appear to be running JavaScript payloads disguised as font files (.woff2) or other suspicious assets. It also monitors for the creation or modification of '.vscode/tasks.json' files by package managers or source control tools, which could indicate the configuration of malicious 'folderOpen' tasks used for persistence or automated execution upon workspace opening.
Detects DcRAT malware creating or modifying a specific file (c:\debug.txt) used for staging keylogging or screenshot data. This rule monitors for file creation followed by modification events, a pattern associated with the adversary's method of log consolidation and potential obfuscation.
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
Page 61 of 109