Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,427
11,813
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects credential harvesting behavior associated with the BQTLock (BaqiyatLock) malware, including the staging of password files in temporary directories, unauthorized access to browser credential stores (e.g., Login Data, key4.db), and the use of system utilities like vaultcmd.exe to interact with the Windows Credential Manager. It also monitors the execution of PyInstaller-packed loaders (BQT.exe or start.exe) from temporary directories.
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
This rule monitors Sysmon Event ID 11 (FileCreate) to detect high-volume file creation activity across multiple unique directories. By filtering out common file types, it identifies potential signs of mass file modification, staging for exfiltration, or malicious encryption characteristic of ransomware or data destructive operations.
Detects potential execution of a Tox ransomware negotiation channel by monitoring for processes that exhibit a high rate of file writes (potential encryption activity) in conjunction with command-line arguments containing specific patterns such as a 76-character string or the 'tox://' URI scheme, which are associated with Tox ransomware client activity.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
Detects anomalous behaviors associated with malicious npm package self-upgrades, where node.exe modifies its own source files within node_modules or spawns npm pack commands to replace existing dependencies with malicious versions.
This rule detects various stages of exploitation associated with the CVE-2026-45257 'BUMSRAKETE' vulnerability, which targets FreeBSD kernels. It monitors for the execution of exploit binaries, compilation of source code related to the exploit, the presence of specific staging files in temporary directories, and the subsequent spawning of shells by the exploit process. It also identifies command-line arguments indicative of BUMSRAKETE activity.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.
This rule detects potentially malicious activity related to cron job scheduling. It monitors for three distinct stages: (1) direct modification of crontab files or directories using common shell utilities, (2) suspicious file write operations to critical cron configuration paths, and (3) execution of shell scripts or binaries from unusual directories (e.g., /tmp, /dev/shm) where the parent process is a cron utility.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
Detects when the SSH daemon or associated client binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) are overwritten or newly created on a Linux system. This is a highly suspicious activity often associated with rootkits, backdoors, or persistence mechanisms aimed at intercepting credentials or maintaining unauthorized remote access.
Detects the use of package management or file integrity monitoring tools (rpm, dpkg, debsums, aide, inotifywait) to verify or interact with critical SSH/PAM configuration files, or the use of inotifywait to monitor SSH configuration access. This behavior may indicate an adversary attempting to verify compromised configurations, check for the presence of backdoors, or monitor security modifications.
Detects the creation or modification of the VbaProject.OTM file, which stores VBA macros for Microsoft Outlook, by a process other than the Outlook application (OUTLOOK.EXE). This is a common technique used to deploy malicious macros for persistence or code execution within the Outlook environment.
This rule detects modifications (such as write, rename, create, or delete events) to critical Linux system files including SSH binaries (sshd, ssh, scp) and PAM authentication modules (pam_unix.so). These files are common targets for adversaries seeking to establish persistence, bypass authentication mechanisms, or gain unauthorized access to credentials.
Detects instances where the legitimate Windows DllHost.exe process creates or modifies executable or script files in common directories frequently used for staging malicious payloads, such as public folders, temporary directories, and program data. This behavior is often associated with process injection or side-loading techniques where a trusted process is abused to drop secondary malicious files.
This rule monitors for suspicious activities related to Pluggable Authentication Modules (PAM) and authentication daemons. It detects unauthorized modifications to PAM configuration and shared object files, unexpected child processes spawned by sshd, the use of LD_PRELOAD in authentication contexts, and the tracing of authentication binaries (e.g., sshd, login, sudo) via strace.
Detects attempts to delete or clear Linux system logs using common utilities (rm, shred, truncate, echo, cat) targeting critical log paths such as /var/log/syslog, /var/log/messages, and other authentication or kernel logs. This activity is indicative of an adversary attempting to remove evidence of their actions from the local system.
Page 63 of 109