Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects malicious activity associated with the Kimsuky NUKESPED campaign, specifically the execution of .jse droppers from the Downloads directory using Windows Script Host (wscript.exe/cscript.exe), execution of known malicious files by SHA256 hash, and the presence or creation of the associated zlrenu8.exe payload.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects potential GCP logging sink bucket hijacking by monitoring for the deletion of a Google Cloud Storage bucket followed closely by an update to a logging sink configuration that points to a GCS destination. This pattern is characteristic of attackers attempting to intercept cloud log streams by recreating a target destination bucket in an environment they control.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects indicators of persistence activity associated with the MYRA RAT. This includes unauthorized modifications to shared library preload mechanisms (/etc/ld.so.preload), creation of malicious shared objects in systemd user paths by common interpreter/shell processes, suspicious modification of cron job files by those same processes, and the execution of the 'systemd-userdbd' process from non-standard, unauthorized filesystem locations.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects the creation or modification of specific DLL and data files associated with the SharkLoader malware (e.g., SystemSettings.dll, DscCoreR.mui) within designated hidden directories (%APPDATA%\xwreg or %APPDATA%\xgdf). These paths are indicative of the StrikeShark campaign, which utilizes DLL side-loading to target diplomatic and government entities.
Detects persistence mechanisms associated with the MYRA Linux RAT, including LD_PRELOAD hijacking for shared library redirection, malicious cron job creation with specific scheduling (13-minute intervals), and unauthorized modifications to profile.d scripts to execute malicious code.
Detects the creation, modification, or deletion of the 'C:\debug.txt' file, which is an artifact associated with the DcRAT malware's screen capture module. The rule specifically monitors for this file's activity and highlights when the deletion is performed by 'svchost.exe', a common process used for masquerading malicious activity.
Detects process execution or file creation/modification events associated with the PACKET_EDIT_MEME (pedit_cow_demo) exploit, which targets Linux kernel vulnerabilities (CVE-2026-46331) for local privilege escalation.
Detects modification of /etc/ld.so.preload to register the MYRA RAT rootkit shared library (.libcache.so) for system-wide LD_PRELOAD injection. The MYRA npm package (apintergrationpost) copies libcache.so to /usr/local/lib/.libcache.so and appends its path to /etc/ld.so.preload, causing the rootkit to load into every new process on the system.
Detects malicious npm package behavior where a package uses 'npm pack' and associated script files (e.g., sync-peer.cjs) to download and overwrite its own installed files. This technique is often used in software supply chain attacks to bypass static analysis of the original package tarball by fetching a second, malicious version at runtime.
Detects the execution of 'unshare' by an unprivileged user to create a new user namespace, followed by a write operation to '/proc/self/uid_map', '/proc/self/gid_map', or '/proc/self/setgroups'. This sequence is a known technique for local privilege escalation (LPE) vulnerabilities, such as those related to unprivileged user namespaces.
Detects node.exe or node process accessing sensitive SSH private key files or configuration files. This behavior is indicative of unauthorized credential harvesting by malicious npm packages or infostealer malware like Miasma/MYRA attempting to exfiltrate developer secrets.
Detects Node.js processes engaging in suspicious behaviors related to supply chain or second-stage attacks. This includes executing scripts from hidden .peer/ directories, accessing specific staging script filenames, and performing DNS requests or network connections to the known malicious domain data-stream.space.
Detects Node.js processes (node, npm, npx) accessing or modifying '.npmrc.bak' or '.npmrc' files located within 'node_modules' directories. This activity is indicative of credential theft, specifically targeting potentially active npm authentication tokens that might have been inadvertently backed up or exposed within project directories.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
Page 79 of 109