Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
Detects the creation of suspicious IDE configuration files (e.g., .vscode/tasks.json or .claude/index.js) associated with the poisoned verana-blockchain Go module, as well as the subsequent execution of these files by the Node.js runtime. This detection aims to identify supply chain compromise attempts targeting developers.
Detects suspicious activities within GitHub repository logs that indicate potential supply chain attacks, including the use of unauthorized workflow names, the creation of orphan snapshot branches, dependabot impersonation attempts, commit messages containing known campaign markers, exposure of internal secrets (HAS_GCR_TOKEN), and the push of suspicious files or configuration modifications.
This rule detects indicators of compromise associated with the TinyRCT malware, including the loading of a malicious AppDomainManager DLL by chrome_setup.exe, network connections to a known TinyRCT staging server, and the dropping of second-stage payloads such as PerfWatson2.exe to the local application data directory.
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
Detects multiple techniques associated with Linux post-exploitation and persistence, including LD_PRELOAD environment variable hijacking, suspicious cron jobs, profile.d persistence modifications, systemd service masquerading via prctl, and fileless execution via memfd_create.
Detects the creation or modification of the .amazonq/mcp.json file in a workspace directory. This file is automatically loaded by the Amazon Q VS Code extension and can be leveraged to achieve remote code execution (RCE) via malicious MCP server command definitions as documented in CVE-2026-12957.
Detects anomalous file activity on removable media drives characteristic of the Gamaredon group's PteroOdd/PteroSetup malware. The rule identifies PowerShell, wscript.exe, or cscript.exe writing autorun.inf or .lnk files to removable drive letters (D-Z), which is a common technique for lateral movement and propagation via USB drives.
Detects instances where the WinRAR utility process creates, writes, or drops a file into the Windows Startup folder. This behavior is a common technique used by adversaries to achieve persistence, as any executable placed in this folder will automatically run upon user login.
Detects attempts to disable or modify critical Linux security subsystems including SELinux and AppArmor. The rule monitors for the execution of commands such as setenforce, aa-teardown, and systemctl, or direct modifications to security configuration files.
Detects unauthorized modification or dropping of model files directly into the local Hugging Face cache directory (~/.cache/huggingface/hub) by non-standard development processes, indicating an attempt to swap legitimate models for backdoored ones.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Detects the creation or modification of '.config' or '.exe.config' files within commonly user-writable directories such as AppData, Temp, Downloads, or Desktop. These files are often used by .NET applications to define behavior, and attackers may manipulate them to perform activities such as assembly redirection, loading malicious DLLs, or altering security settings for elevated processes.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Detects unauthorized access, modification, or deletion attempts against common web browser credential storage files (key4.db, logins.json, and Microsoft Edge 'Login Data'). These files store sensitive authentication information, and non-browser processes interacting with them are indicative of credential harvesting attempts.
Detects unauthorized access, modification, or deletion attempts against common web browser credential storage files (key4.db, logins.json, and Microsoft Edge 'Login Data'). These files store sensitive authentication information, and non-browser processes interacting with them are indicative of credential harvesting attempts.
This rule detects unauthorized access, creation, or modification of browser-specific sensitive credential files (such as 'Login Data' or 'cookies.sqlite') by processes that are not recognized web browsers or trusted update services. This behavior is a common indicator of information-stealer malware attempting to harvest session cookies and stored credentials.
Detects attempts to extract the Security Account Manager (SAM) database, either by using the 'reg save' utility to export registry hives containing the SAM or by directly creating/modifying the SAM file on disk outside of known legitimate system processes.
This rule detects a high frequency of file rename or modification events targeting files with extensions commonly associated with ransomware. It filters out activity from processes signed by trusted vendors like Microsoft, Symantec, Sophos, and Trend Micro to reduce noise, flagging mass rename operations that could indicate an active ransomware encryption process.
Detects the modification or creation of registry values under the Windows Local Security Authority (LSA) configuration key, specifically targeting the 'Authentication Packages' or 'Security Packages' values. Adversaries often use these registry locations to inject custom DLLs that are loaded by the LSA process (lsass.exe) at system boot for persistence or credential dumping.
Page 74 of 109