Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects suspicious file creation or modification events in the root directory (C:\) for files commonly associated with boot sectors, such as 'bootsect.bak', 'bootloader', 'MBR', and 'VBR'. Such modifications can indicate ransomware activity or other forms of boot integrity compromise.
This rule detects unauthorized access or modification attempts to the Microsoft WinGet DSC (Desired State Configuration) configuration history database and associated YAML configuration files. WinGet stores execution history and DSC configuration files in specific directories; unauthorized processes interacting with these files may indicate an attempt to gain persistence, escalate privileges, or conduct reconnaissance on configured system states by inspecting or tampering with deployment manifests.
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
Detects instances where the SSH daemon (sshd) or its related components, such as PAM libraries, create or write to files located in /tmp/ or hidden files in /var/ directories, which may indicate unauthorized configuration changes, credential manipulation, or staging of malicious files.
This rule detects unauthorized or suspicious write operations to Linux Pluggable Authentication Modules (PAM) configuration files or shared libraries. PAM controls authentication for various system services; unauthorized modification of these files is a common technique used by attackers to establish backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common system package management utilities to reduce noise.
Detects the creation or modification of files within /etc/systemd/system/ or /etc/init.d/ by non-standard management processes. Attackers often use these paths to establish persistence by creating or altering service unit files to execute malicious code automatically upon system boot or service restart. The rule specifically excludes common system management tools.
Detects instances where the sshd process or PAM-related processes create or write to files within temporary directories (/tmp/ or /var/). This behavior is often associated with the staging of malicious scripts, backdoors, or tools during an attack involving credential abuse or unauthorized access via SSH.
Detects instances where the DllHost.exe process creates or writes files with common executable or script extensions (.exe, .dll, .ps1, .bat, .cmd, .vbs, .hta, .scr, .sh) into suspicious, publicly writable, or temporary directories. This behavior is indicative of potential malicious payload staging, masquerading, or post-exploitation activity.
This rule detects two suspicious behaviors associated with OpenSSH components: the direct modification or replacement of critical OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp), or the use of these processes to write files to suspicious or non-standard locations (such as /tmp/ or unauthorized subdirectories within /var/log/), which may indicate credential harvesting or the presence of a backdoor.
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.
Detects suspicious activity related to the OpenSSH server suite, including unauthorized modifications to core SSH binaries by non-package-manager processes, sshd processes writing files to temporary directories (a common indicator of credential harvesting), and sshd execution from non-standard file paths which may indicate a trojanized binary or persistence mechanism.
Detects DLL side-loading activity associated with the JFMBackdoor malware. The rule identifies the execution of the legitimate Windows filter manager control utility (fltMC.exe) from suspicious locations (TEMP/tmp directories) and the creation of companion payloads (FLTLIB.dll, flt.bin, or scr.mui) in those same directories, which are characteristic of the JFMBackdoor dropper chain.
This rule detects activities associated with the Kimsuky NUKESPED malware loader, including the execution of malicious .jse scripts, PowerShell-based obfuscated payload decoding using 'ProgramData' as a staging path, and the subsequent execution of the 'zlrenu8.exe' payload. The rule specifically targets the multi-stage infection chain where scripts are used to perform anti-analysis and sandbox evasion before launching the primary malicious component.
Detects malicious dropper behavior involving batch files spawning hidden PowerShell processes to download components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) to temporary directories. The rule further tracks the execution of the dropped fltMC.exe and the creation of the associated DLL/binary files, which is indicative of JFMBackdoor DLL side-loading.
Detects the creation or modification of files within the 'C:\ProgramData\Windows Multimedia' directory, a path associated with JFMBackdoor's screen capture output. The rule specifically monitors for this activity when initiated by 'fltMC.exe', which is known to be used by this malware for DLL side-loading.
Detects execution and staging activity associated with the NUKESPED (zlrenu8.exe) backdoor. The rule monitors for direct process execution from ProgramData, malicious DLL registration using rundll32, the creation of staged payload files in ProgramData, and suspicious memory operations (VirtualProtect) by the backdoor process, which are indicative of reflective loading or shellcode execution.
Detects malicious activity associated with the Kimsuky threat group's NUKESPED JSE loader, including the use of wscript/cscript to execute .jse files, drop encoded payloads via ADODB.Stream, and spawn hidden PowerShell processes for decoding stages (targeting .a9oc files in ProgramData). The rule also detects the creation and execution of the NUKESPED secondary payload zlrenu8.exe.
Page 78 of 109