Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,427
11,813
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects screen capture activities associated with DcRAT, Millenium RAT, and Operation DragonReturn. It identifies the creation of specific staging files (e.g., debug.txt, background.jpg) at sensitive paths and monitors for non-standard or masquerading processes (such as svchost.exe running outside System32) that create image files in user-writable or temporary directories. The rule uses tiered logic, assigning a higher risk score to known IOC patterns and periodic capture behavior.
This rule detects file creation, modification, or module loading events involving specific DLL files ('msvcr90.dll' or '7z.dll') from a suspicious directory path ('Traiolx Custom Utils'). This behavior is commonly associated with DLL side-loading, where an adversary places malicious or renamed legitimate DLLs into a specific directory to hijack execution flow.
Detects the presence of known malicious Chrome extension IDs, suspicious configuration files (e.g., perplexity-rules.json, bing-rules.json), or extensions utilizing invasive declarativeNetRequest permissions, which are often used for browser-based exfiltration or credential interception.
This rule detects a two-stage DLL sideloading chain associated with Mustang Panda campaigns, specifically utilizing the SHARDLOADER and ZOHOMURK malware components. It monitors for the loading of malicious DLLs ('SolidPDFCreator.dll', 'ctxmui.dll') by specific binaries, as well as the execution of associated staging processes and file creation events in public directories.
Detects malicious activities associated with The Gentlemen RaaS group, specifically targeting GPO modifications to distribute ransomware, disable Windows Defender Real-time Monitoring, and deploy persistence mechanisms via scheduled tasks in SYSVOL or NETLOGON paths.
Detects the installation of the NexShield malicious Chrome extension, which impersonates uBlock Origin Lite. The rule monitors for the creation or modification of 'manifest.json' files within Chrome extension directories and registry key activity related to the extension's installation, specifically flagging references to 'NexShield' or deceptive 'uBlock Origin Lite' naming conventions.
Detects the exploitation chain of the DirtyClone (CVE-2026-43503) vulnerability on Linux systems. The rule monitors for a sequence involving an unprivileged user (UID > 1000) creating a new user/network namespace, configuring an IPsec XFRM state with loopback source/destination addresses, modifying sensitive memory via /proc/self/mem or /proc/<pid>/mem to bypass Copy-on-Write (CoW) protections, and ultimately spawning a process with root privileges.
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Detects the configuration and usage of personal Microsoft OneDrive accounts on corporate endpoints. This is achieved by monitoring for OneDrive process execution with personal account command-line arguments, OneDrive setup utilities configured with personal tenant identifiers, and file system activity within directory paths associated with personal OneDrive synchronization.
Detects the use of the Windows 'fsutil' utility with the 'setZeroData' argument to zero out file content. This technique is often used by adversaries to perform data destruction or prevent file recovery.
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
Detects unauthorized persistence mechanisms on Cisco SD-WAN Manager, vSmart, and vBond nodes by monitoring for local account creation (e.g., useradd), modification of sensitive authentication files (/etc/passwd, /etc/shadow), and illicit SSH key placement in authorized_keys. This rule specifically monitors for known exploit paths involving the 'troot' account and related command-line activity indicative of unauthorized administrative access.
Detects the creation or modification of specific suspicious .pyd files (Python extension modules) within temporary directory paths, excluding legitimate processes or publishers associated with Python Software Foundation or Microsoft Corporation. This behavior is indicative of potential side-loading or persistence mechanisms involving malicious Python extensions.
This rule detects anomalous activities associated with RustDesk, such as spawning suspicious child processes, dropping files related to known session permission bypass proof-of-concepts, communicating with non-standard relay servers, or performing file write operations in sensitive system temporary directories, which indicates potential session hijacking or unauthorized remote access.
Detects unauthorized writes to the /proc/sys/vm/drop_caches interface by non-root users or processes that are not standard system maintenance tools. This activity is a known post-exploitation technique used by exploits like the 'pedit' COW exploit to clear cached setuid binary pages in memory for evasion or cleanup.
Detects anomalous, high-volume file creation patterns in temp directories characterized by UUID-style filenames from non-system processes. This behavior is indicative of a multi-threaded I/O saturation technique used by the RoguePlanet exploit to create a race condition (TOCTOU) against Microsoft Defender (MsMpEng.exe).
Detects unauthorized modifications to FreeBSD init scripts located in /etc/rc.d/, /usr/local/etc/rc.d/, or /etc/rc.subr. These directories are used for system service startup. The rule specifically monitors for modifications related to the BRICKSTORM persistence mechanism, which targets these scripts to execute malicious binaries such as /usr/local/libexec/ipsec/blacklist.
This rule detects potentially malicious activity related to the cron utility, including the modification of cron-related configuration files and the execution of specific suspicious payloads (e.g., ssync.sh, blacklist). It monitors for file creation, modification, or renaming events within sensitive directories, as well as the spawning of processes by cron daemons using identified suspicious paths or command names.
Page 62 of 109