Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects the creation of suspicious NTFS Alternate Data Streams (ADS) commonly associated with malicious activities. Specifically, it monitors for the use of the ':WDFOO' stream name within temporary directories, which is a known indicator of certain malware or post-exploitation staging behaviors. Additionally, it identifies attempts by 'wermgr.exe' (Windows Error Reporting Manager) to interact with temporary files in these paths, which may suggest masquerading or living-off-the-land techniques.
Detects an unprivileged process executing from a user-specific temporary directory with the 'RP_' prefix, while simultaneously interacting with specific file patterns in 'C:\Windows\Temp'. This behavior is consistent with the 'RoguePlanet' Time-of-Check to Time-of-Use (TOCTOU) exploit, which uses junction-swap techniques to manipulate Defender quarantine workflow files to achieve privilege escalation.
Detects unauthorized ISO or virtual disk mounting activity combined with the creation of a working directory using the 'RP_' prefix under the system temporary folder. This pattern is indicative of the RoguePlanet exploit staging process, which often uses NTFS junction redirection to bypass security controls like Windows Defender quarantine.
This rule detects the execution and creation of suspicious files named 'winupdate.exe' or 'SLaunch.exe' within the AppData cache directory, or processes involving 'YutaCore.dll' or a specific local host URL. It also checks for the execution of known malicious file hashes associated with this behavior.
Detects the RoguePlanet quarantine artifact hijack technique, which involves two primary signals: the staging of 'wermgr.exe' within temporary 'RP_*' working directories and the unauthorized creation or modification of 'wermgr.exe' in 'C:\Windows\System32' by processes other than trusted Windows system components.
Detects anomalous activity involving the Windows Error Reporting service executable, wermgr.exe. This includes the suspicious creation of files within temporary directories that match known junction-based exploitation techniques, the creation of a 'wdtest_temp' subdirectory (often used as a working directory in exploit staging), and the execution of wermgr.exe from a path other than the expected Windows System32 directory.
Detects unauthorized access to wermgr.exe residing within Volume Shadow Copy paths or staged in specific temp directories. This behavior is associated with the RoguePlanet exploit, which uses this pattern to obtain SYSTEM-readable handles for subsequent oplock placement and TOCTOU (Time-of-Check Time-of-Use) race conditions to achieve privilege escalation.
Detects unauthorized attempts to place an exclusive byte-range lock on the wermgr.exe executable when accessed via Volume Shadow Copy (VSS) or temporary paths, which is characteristic of the RoguePlanet exploit. This technique is designed to stall Windows Defender's clean-up operations, creating a time-of-check to time-of-use (TOCTOU) race window for further exploitation.
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
This rule monitors for the creation or modification of files containing the string 'readme_locker' in their filename. This pattern is commonly associated with ransomware strains that leave behind ransom notes, often as part of the data encryption impact phase.
Detects malicious artifacts and behaviors associated with TA4922 (Atlas RAT, SilentRunLoader, RomulusLoader), including known malicious file hashes, DLL sideloading patterns masquerading as legitimate graphics libraries, and unauthorized execution of Python interpreters from user-writable directories.
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Detects a non-browser process reading browser profiles, cookies, form stores, or session files from Chrome, Edge, Brave, or Opera browsers. The rule specifically looks for file events (creation, writing, deletion) on browser-related files like 'Cookies', 'Login Data', 'Web Data', 'History', or 'Local State' within browser user data directories, where the process performing the action has a filename matching common RAT patterns like 'banana', 'client', 'update', or 'service'.
Detects potential execution of a Tox ransomware negotiation channel by monitoring for processes that exhibit a high rate of file writes (potential encryption activity) in conjunction with command-line arguments containing specific patterns such as a 76-character string or the 'tox://' URI scheme, which are associated with Tox ransomware client activity.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
Detects persistence and execution behaviors associated with the MYRA Linux RAT. The rule monitors for the installation of a malicious library (.libcache.so) via shell profile modifications, and subsequent execution attempts where a process masquerades as 'systemd-userdbd' while utilizing 'LD_PRELOAD' and fileless execution techniques (memfd_create/fexecve).
Detects persistence and fileless execution techniques associated with the MYRA Linux RAT. This includes monitoring for the creation of persistence files such as /usr/local/lib/.libcache.so for LD_PRELOAD hijacking and /etc/profile.d/.sh.local for shell-based persistence. It also monitors for suspicious process execution patterns where 'node' spawns a 'systemd-userdbd' masquerading process or invokes syscalls indicative of fileless execution, specifically memfd_create or fexecve.
Detects the Polymarket Trap technique where a Node.js process executes 'npm pack' during a post-install phase and subsequently overwrites core module files (e.g., index.js) within the node_modules directory. This behavior is used to evade static analysis and conceal malicious code within legitimate dependency files.
Detects unauthorized modification of file flags on core system binaries (e.g., /bin, /sbin, /usr/bin) followed by write/modification operations. This behavior is indicative of an attacker attempting to bypass immutable flags to modify or replace critical system files, often seen in rootkits or malware to achieve persistence or tamper with system integrity.
Page 77 of 109