Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects behavior consistent with the SharkLoader malware, including the creation of malicious components in %APPDATA% subdirectories (xwreg, xgdf), the execution of SystemSettings.exe from these non-standard directories, and the execution of commands via cmd.exe initiated from these paths. It also identifies file staging activities in %TEMP%\aswerf.
Detects file write or delete operations involving cmd.exe by processes potentially associated with the TrymeLocker ransomware, specifically looking for indicators of ownership or permission modification (takeown, icacls) and suspicious file paths.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects the use of the 'fsutil.exe' utility with the 'setZeroData' argument to perform zero-byte file filling, often used to make files unrecoverable. The rule further filters for command lines containing common file deletion commands like 'del' or network connectivity tests like 'ping', indicating possible malicious file removal or destruction activity.
Detects the creation, reading, or execution of payloads stored within NTFS Alternate Data Streams (ADS). This technique is commonly used by adversaries to hide malicious content within file metadata to evade security tools. The rule monitors process command-line arguments for ADS syntax, identifies usage of utilities like type, Get-Content, wmic, or various LOLBins (e.g., regsvr32, rundll32) interacting with ADS paths, and flags anomalous file creation/modification events that involve ADS, excluding known system-generated streams.
Detects persistence mechanisms associated with the MYRA Linux RAT, including the use of LD_PRELOAD to load a malicious shared library from a hidden path, persistent shell profile modification via /etc/profile.d/.sh.local, and process masquerading as systemd-userdbd. This rule is linked to the Polymarket Trap campaign involving malicious npm packages.
Detects unauthorized access (creation, modification, renaming, or deletion) to sensitive local credential files by the Node.js runtime process (node.exe/node). This behavior is indicative of infostealers, specifically noted in the Miasma/MYRA activity associated with the Polymarket Trap campaign, where malicious packages attempt to exfiltrate AWS, SSH, NPM, Python, Docker, and GPG credentials.
Detects periodic screen captures being written to the AppData\Roaming\Screenshots directory with specific timestamped naming patterns (time_YYYYMMDD_ or wnd_YYYYMMDD_) often used by Remcos RAT to exfiltrate user activity.
This rule detects the creation or modification of files that contain common certificate-related keywords such as 'crl', 'certificate', or 'pem'. This activity could indicate the deployment of new certificates, which might be legitimate or malicious, such as for establishing command and control, code signing, or evading detection.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
Detects the creation or writing of files within AppData directories matching specific naming patterns associated with Remcos RAT activity. Remcos typically generates files with a prefix of 'time_' or 'wnd_' followed by a timestamp string in these locations to store collected data or screenshots.
Detects anomalous self-upgrade behavior in npm packages where a node process spawns child processes using npm pack or specific command-line arguments to overwrite installed package files. This pattern is associated with malicious supply chain activity, specifically seen in the wshu.net campaign where packages download and replace their own contents at runtime.
Detects rapid successive password changes to the default 'admin' account on Cisco SD-WAN controllers followed by a configuration rollback. This pattern indicates an adversary attempting to temporarily modify credentials for exploitation while attempting to evade detection by reverting to the original configuration state, specifically targeting NETCONF configuration commits.
Detects the creation or manipulation of the 'troot' root-privileged backdoor account on Cisco Catalyst SD-WAN controllers, associated with the UAT-8616 exploit chain. The rule monitors for direct modification of /etc/passwd or /etc/shadow files, usage of useradd, grep operations on passwd files, and execution of su to the troot account.
Detects anomalous post-compromise activity associated with Browser-in-the-Browser (BitB) attacks or general credential theft. Specifically, it monitors for browser processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are typically used for payload delivery, and unauthorized access to browser-stored credential files (e.g., 'Login Data') by non-browser processes.
This rule monitors for the execution and network activity of known data exfiltration tools such as WinSCP, rclone, and MegaSync. It also tracks the creation of configuration files associated with these tools and monitors DNS requests and browser navigation to known cloud storage and file-sharing destinations. This behavior is indicative of data staging and unauthorized exfiltration.
This rule detects potential re-compromise attempts by monitoring for access, file creation, or process execution associated with a set of known malicious web shell files. It correlates IIS web server logs (HTTP POST requests to shell files), EDR file modification events, and EDR process spawning events from common web server binaries (w3wp.exe, coldfusion.exe, jrun.exe) to identify persistence remaining after remediation.
Detects the modification or creation of .aspx files within the ColdFusion 'wwwroot\Images' directory. The rule flags both known webshell filenames and generic .aspx files that are not modified by the IIS worker process (w3wp.exe), which is indicative of unauthorized file manipulation or webshell deployment.
Detects artifacts associated with the Remcos RAT keylogger, specifically the creation or modification of 'logs.dat' within 'AppData\Roaming\DT' and the registration of a 'WH_KEYBOARD_LL' hook via 'SetWindowsHookEx' API calls, which is indicative of keylogging functionality.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Page 71 of 109