Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects BeepRAT malware activity, including network communication to its command-and-control (C2) server on port 18848 and the creation of screenshot or video artifacts by known loader processes (HFY.exe, LuaJit.exe, tcc.exe). It also monitors for unauthorized network connections to the known BeepRAT C2 IP address.
Detects unauthorized processes reading, creating, or modifying sensitive files associated with local AI development tools and assistants (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). This rule monitors for file operations outside of the known, legitimate AI tool processes, suggesting potential credential theft or configuration tampering by malicious software.
This rule detects the installation and activity of a malicious Google Chrome extension used to hijack the browser's default search provider. The rule triggers on a multi-stage process involving the creation of a specific malicious extension directory, modification of the Chrome Preferences file to change search settings, tampering with the 'PreferenceMACs' registry keys to bypass browser-based integrity warnings, and subsequent network communication with a known malicious C2 domain associated with the search hijack.
This rule detects potentially malicious activities related to the manipulation of Group Policy Objects (GPOs) within an Active Directory environment. It identifies the execution of scripts or processes that create, modify, or force GPO updates (e.g., using 'gpupdate /force'), the deployment of suspicious GPO-related files like 'deploy_gpo.ps1', the manual modification of 'ScheduledTasks.xml' within the SYSVOL directory, and the use of PowerShell to disable real-time monitoring via GPO configuration changes.
Detects potentially unauthorized or malicious Group Policy Object (GPO) modifications and deployment activities. This includes the creation or modification of GPO files on domain controllers (SYSVOL/NETLOGON shares), the use of specific PowerShell scripts associated with GPO deployment, execution of forced group policy updates, and attempts to disable real-time security monitoring via GPO context.
This rule detects potentially malicious child processes spawned by Node.js or npm, as well as specific file activity related to VS Code configuration or Node module directories that may indicate supply chain or development environment tampering. It flags processes like cmd.exe, powershell.exe, or python.exe being executed by code.exe or node.exe, and monitors for modifications to tasks.json or eslint-check files within sensitive directories.
Detects modification of scripts in extension folders.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects the creation of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508.
Identifies the Potentially Unwanted Program (PUP) forcibly modifying Chrome or Edge extension directories or registry preferences to inject malicious stealers. This rule specifically looks for file creation or modification events within browser extension folders, initiated by common installer/updater executable names.
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
Detects the creation or modification of a file named 'logs.dat' within the 'AppData\Roaming\DT\' directory by processes other than 'explorer.exe' or 'system'. This pattern is often indicative of malware or unwanted programs attempting to establish persistence or store data in a hidden or less scrutinized location.
Detects internal web server content modification for defacement
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Detects network connections to the typosquatted domain 'perplexity-ai.online', associated with a malicious browser extension used for data exfiltration. Additionally, it detects the creation or modification of 'background.js' files within common web browser extension directories, which is a common persistence mechanism for malicious extensions.
Detects anomalous child process creation or .lnk file interaction by the LunarClient process. This rule monitors for indicators of potential supply chain compromise or malicious activity where the gaming client spawns shells, scripting interpreters, or network utilities, or generates shortcut files to facilitate further execution.
This rule detects installation artifacts, configuration file modifications, registry changes, and network activity associated with a specific malicious Chromium extension ('flkebkiofojicogddingbdmcmkpbplcd') that hijacks the default browser search provider via declarativeNetRequest rules and communicates with a typosquatted domain 'perplexity-ai.online'.
Detects artifacts and behaviors associated with a malicious Chromium extension identified as 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for unauthorized extension installation, registry modifications to the browser's default search provider settings pointing to a suspicious domain (perplexity-ai.online), and outbound browser network traffic or DNS queries directed toward the same domain for potential data exfiltration.
Detects replacement of critical system binaries for persistent code execution
Detects modification of udev rules for persistent command execution on device events
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Page 82 of 109