Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects a specific command-line pattern executed via `cmd.exe` that is associated with the ClickFix attack. The pattern involves moving an `update.zip` file from the user's downloads directory, extracting a `u.zip` file in the temporary directory using `tar`, and then executing an `update.bat` script. This sequence of actions is indicative of a multi-stage malicious payload deployment.
This rule monitors for suspicious file operations on Cisco vManage, vSmart, and vBond network devices. It detects attempts to delete system logs, unauthorized access or copying of sensitive system files (such as /etc/passwd or /etc/shadow), and the presence of suspicious strings in command lines that may indicate anti-forensic activity or the creation of rogue accounts.
Detects the creation or modification of VS Code tasks.json files containing the folderOpen trigger by non-editor processes. This technique can be abused to achieve automatic code execution when a project folder is opened, a method known to be used by malicious npm packages to execute payloads disguised as benign files.
Detects various suspicious activities related to macOS wallet applications, including the removal of Gatekeeper quarantine flags, ad-hoc re-signing of application bundles, force-killing wallet applications, non-installer processes writing to application bundles (specifically 'app.asar'), and the use of 'dscl . authonly' which can be abused for fake password prompts.
Detects writing to /proc/self/mem for in-memory code injection on Linux
Detects concurrent suspicious network beaconing to Telegram API or IPInfo and high-volume destructive file operations (deletion or modification) on a specific host, indicative of TrymeLocker ransomware activity.
Detects the execution behavior associated with the VILE ransomware, specifically focusing on the combination of privilege manipulation API usage (e.g., AdjustTokenPrivileges, DuplicateTokenEx) and the creation of known ransomware-related artifacts like configuration files or decoy files.
Detects core indicators of Grixba malware, including the persistence path of GT_NET.exe in the Public Music directory, the loading of the associated malicious CoreScanner module (inf_g.dll), staging of reconnaissance output files, and the use of GT_NET.exe to perform network lateral movement via WMI/WinRM ports.
Detects the sudo phishing routine writing the XOR-encoded stolen macOS user password to the hidden ~/.zsh_cache file.
Detects the suspicious installation and execution of a Python runtime from within a disguised directory (%LOCALAPPDATA%\Programs\Python\Python3127). This behavior is characteristic of an infostealer campaign that leverages Node.js to download archive files (python.zip, python.7z) and archiving tools (7zr.exe) to bootstrap a Python-based malicious payload.
This rule detects the creation, modification, or renaming of files that are explicitly named after known security research projects, proof-of-concept exploits, or common testing artifacts (e.g., pedit_cow_demo, packet_edit_meme). These files are often associated with exploit development or security testing activities.
Detects the creation or modification of '.amazonq.mcp.json' files associated with the Model Context Protocol (MCP) in VS Code or similar IDE environments, alongside the subsequent spawning of shell interpreters (bash, sh, cmd, powershell, python, npx) from these IDE processes. The rule further flags these events as 'HIGH' priority if the command line references sensitive patterns like AWS credentials or SSH/AWS paths, suggesting potential credential harvesting or unauthorized post-exploitation activity originating from the IDE environment.
Detects the execution of potentially suspicious cleanup and maintenance commands (e.g., clearing history, changing permissions, removing files) on Linux systems that are often associated with post-exploitation activity or evidence removal. The rule monitors for these patterns specifically when initiated by commands involving common suspicious file paths like 'isp.sh', 'lambsys', or '/var/tmp/.xlamb'.
Detects the WinRAR process creating or modifying files within the Windows Startup folder. This activity is a common technique used by attackers to achieve persistence by ensuring that a malicious payload or script is executed automatically upon user logon.
Detects instances where the WinRAR process is used to create or modify files within the Windows startup directory. This behavior is highly suspicious and often indicates an adversary attempting to establish persistence by placing a malicious script or executable in a location that executes automatically upon user login.
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
Detects USB-based lateral movement and persistence techniques associated with the Gamaredon group (PteroOdd/PteroPaste). The rule monitors for the connection of removable media followed by the creation of LNK files targeting AppData/Temp directories or UNC paths by specific processes (Office, Scripting engines, PowerShell), and the subsequent creation or modification of autorun.inf files on the same removable device.
Detects persistence mechanisms used by the lambsys/procq cryptominer. It identifies two specific behaviors: 1) Correlation of non-root process execution (isp.sh, lambsys, procq) followed within 120 seconds by modifications to cron configuration files (e.g., /etc/cron.d/, /var/spool/cron/crontabs/) containing suspicious command-line patterns or mining pool references. 2) Direct detection of crontab -e invocations using heredoc redirection (<<) to install persistence payloads that match known miner dropper patterns and mining pool endpoints.
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects memory writes to ntdll.dll's NtTraceEvent function patched with a single RET (0xc3) byte, disabling ETW-based tracing across the host — a precision anti-forensics technique used by the SilverFox loader chain.
Page 76 of 109