Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects a sequence of suspicious activities: the creation or modification of an executable file (.exe or .dll) within a directory path containing update-related keywords, followed by the execution of a file in that same location, and culminating in an outbound network connection from that process. This pattern is characteristic of a software supply chain compromise or an adversary deploying a malicious payload via a fake or compromised update mechanism.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
Detects the creation or modification of a file named 'help.php' within directories associated with REDCap deployments. This activity is a known persistence mechanism used by threat actors like UNC6508 to establish web shell access.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Detects indicators associated with the deployment and execution of NetSupport RAT, including the launch of 'client32.exe', loading of the 'pcicl32.dll' module, outbound network connections, and the creation of the 'client.ini' configuration file. It also flags execution chains where 'client32.exe' is spawned by common browser or living-off-the-land processes.
Detects evidence of credential dumping activities, including the execution of known Mimikatz-related binaries or command lines, unauthorized memory dumping of the LSASS process using tools like procdump or rundll32 with comsvcs.dll, and the presence of known credential dumping artifacts on disk. It also monitors cross-process access to lsass.exe by potentially unauthorized or unsigned processes.
Detects potential timestomping activities via PowerShell APIs or touch.exe usage, alongside the creation or modification of known webshell filenames in web directories or files placed in common web root subdirectories by web server processes.
Detects attempts to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) using PowerShell Set-ItemProperty cmdlets or command-line tools like 'touch'. This behavior is often associated with adversary attempts to hide artifacts or modify forensic timelines, specifically when targeting directories associated with web servers.
This rule detects potential file timestamp manipulation (timestomping) and suspicious file operations commonly associated with web shell installation on Windows systems. It monitors for PowerShell commands, touch.exe execution, and cmd.exe file copy operations directed at web directories, as well as file write events involving specific known web shell filenames.
Detects indicators of Akira ransomware activity, specifically the deletion of Volume Shadow Copies using vssadmin, the creation of known Akira ransom notes (akira_readme.txt, restore_files.txt), and the generation of files with the .akira extension.
This rule detects the creation or modification of .aspx or .php files within a 'wwwroot/images' directory, specifically where the time difference between consecutive creation events for the same file path exceeds 24 hours (86400 seconds). This behavior is often associated with the placement of web shells or backdoors in web server directories, where adversaries attempt to masquerade malicious scripts as image files.
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
Detects endpoint file creation or modification events involving PDF files with suspicious, lure-like filenames (e.g., 'Settlement Agreement') being written by email clients or web browsers. This rule acts as a proxy for identifying potential spearphishing attachment execution on the endpoint.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects activity associated with the malicious 'Search for perplexity ai' browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). It specifically identifies DNS queries and network connections to the malicious domain 'perplexity-ai.online' initiated by common web browser processes, as well as file system evidence of the extension's presence.
Detects the creation or modification of an mcp.json file within IDE configuration directories (.vscode, .amazonq), followed shortly by the execution of shell or interpreter processes (bash, sh, cmd, powershell, npx) by the IDE process. This behavior suggests the installation of a malicious Model Context Protocol (MCP) server configuration that could facilitate command execution or persistence within the developer environment.
Detects potential ransomware activity characterized by a high volume of file modifications (create, write, rename) involving common document/data extensions, combined with the execution of commands designed to inhibit system recovery (shadow copy deletion, BCD modifications) or perform network share enumeration within the same timeframe and on the same host.
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects high-volume file modification or renaming operations targeted at specific file extensions (dcm, tf, parquet) commonly associated with sensitive data (DICOM imaging, Terraform states, database parquet files) or operations occurring within Docker volume directories. The detection uses an aggregation logic to identify when a process performs more than 20 such file operations on an endpoint, which may indicate bulk data exfiltration, encryption, or tampering.
Page 65 of 109