Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects instances of the JFMBackdoor malware performing timestomping operations within the 'C:\Users\public\jfm\' directory. The malicious activity involves the use of fltMC.exe to perform DLL sideloading, followed by modifying file timestamps to evade forensic analysis and timeline reconstruction, specifically observed as part of the Red Lamassu command 0xE subcommand 0x10.
Detects unauthorized modifications to Nginx configuration files by processes other than the Nginx service itself, known package managers, or common configuration management tools. This behavior is indicative of potential malicious activity, such as the injection of proxy directives (e.g., fastcgi_pass, proxy_pass) as observed in the Velvet Ant Operation Highland, used to pivot traffic into protected or air-gapped network segments.
Detects instances where the creation timestamp of a file is reported as being significantly older (more than 30 days) than the actual file creation event time, as recorded by Sysmon Event ID 2. This is a common indicator of timestomping, where attackers modify file creation metadata to evade detection or blend in with legitimate system files.
Detects execution of fltMC.exe from a location other than the standard Windows System32 directory, correlated with recent file creation or modification events in sensitive directories like ProgramData or User Public folders. This behavior is indicative of an attacker attempting to load malicious kernel-mode drivers or perform system-level operations using a renamed or moved system utility.
Detects unauthorized file operations (Creation, Modification, Rename, Deletion) on sensitive browser-related credential files (e.g., Login Data, Cookies, key4.db) by potentially unauthorized or suspicious processes identified by name.
Detects unauthorized file operations (Creation, Modification, Rename, Deletion) on sensitive browser-related credential files (e.g., Login Data, Cookies, key4.db) by potentially unauthorized or suspicious processes identified by name.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Detects attempts to extract the Security Account Manager (SAM) database, either by using the 'reg save' utility to export registry hives containing the SAM or by directly creating/modifying the SAM file on disk outside of known legitimate system processes.
Detects post-exploitation activities on SD-WAN appliances, including unauthorized tenant list uploads related to CVE-2026-20245, creation of unauthorized 'troot' accounts in sensitive system files, staging of system files, unauthorized permission modifications via chmod/chown, and privilege escalation attempts using su.
Detects indicators of exploitation related to CVE-2026-20245 on Cisco Catalyst SD-WAN controllers, including malicious tenant CSV uploads, unauthorized account creation (troot), privilege escalation via su, anti-forensic backup of system configuration files, and configuration changes such as PermitRootLogin enabled.
Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.
This rule detects potentially suspicious activity related to VS Code extensions or development environments, specifically targeting the creation of 'tasks.json' files by Node.js processes, or the spawning of suspicious child processes (such as shells or interpreters) by VS Code-related processes with command lines associated with common malicious patterns or unauthorized automation.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
This rule monitors for potential abuse of the Microsoft Management Console (mmc.exe) to proxy malicious activity. It detects three primary behaviors: 1) mmc.exe being launched with a .msc file originating from user-writable or suspicious directories; 2) mmc.exe spawning known suspicious child processes (e.g., powershell.exe, cmd.exe, rundll32.exe); and 3) the creation or modification of .msc files in suspicious locations by processes other than mmc.exe or msiexec.exe.
This rule detects ransomware activity by identifying two primary indicators: a high volume of file renames to common ransomware extensions within a 5-minute window, and the creation of known ransom notes across multiple directories. It excludes processes signed by trusted vendors to minimize noise.
Detects potential dynamic linker hijacking on Linux systems by monitoring for the use of non-standard LD_PRELOAD paths in process command lines or unauthorized modifications to the /etc/ld.so.preload configuration file, which can be used to inject malicious code into processes.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
This rule detects indicators of Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Evilginx2 and similar proxy frameworks. It identifies unauthorized execution of Evilginx2 binaries, the presence of specific session and configuration files (.evilginx/, phishlets, session databases), unauthorized modifications to Nginx configurations, and the dropping of suspicious HTML lure files into web document roots by scripting interpreters.
Detects the abuse of the CertUtil.exe Windows utility to download, decode, encode, or split files. This behavior is considered suspicious when initiated by common command-line shells or Office applications, which are frequently used as entry points for malicious scripts or macro-based attacks.
Detects various techniques used by an attacker to escape a container environment or gain unauthorized access to host-level resources. This includes the execution of namespace manipulation tools (nsenter, unshare, chroot), unauthorized access to the docker.sock Unix socket, mounting of host filesystems from within a container, and direct attempts to access the host's /proc/1 namespace files.
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
Page 70 of 109