Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects potential WMI persistence mechanisms by monitoring the execution of 'mofcomp.exe' by non-Microsoft signed binaries, the creation of MOF files in suspicious user-writable directories (Temp, AppData, etc.), and the suspicious execution of 'scrcons.exe', which is the WMI permanent event consumer process.
Detects potential WMI persistence mechanisms by monitoring the execution of 'mofcomp.exe' by non-Microsoft signed binaries, the creation of MOF files in suspicious user-writable directories (Temp, AppData, etc.), and the suspicious execution of 'scrcons.exe', which is the WMI permanent event consumer process.
Detects potential activity associated with the AMOS infostealer, where common terminal commands (cp or mv) are used to manipulate or replace legitimate Ledger Live or Trezor Suite cryptocurrency wallet applications located in the /Applications directory on macOS.
Detects the creation or modification of a file named 'dui70.dll' (or variants if renamed) within non-standard, user-writable directories such as AppData or Temp. This behavior is indicative of malware, specifically the OXLOADER payload, preparing for module-stomping by placing a malicious DLL copy outside legitimate Windows System32 or SysWOW64 paths.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
Detects suspicious activity related to the Print Spooler service (spoolsv.exe), specifically focusing on the spawning of known command-line interpreters (cmd.exe, powershell.exe, rundll32.exe) by spoolsv.exe, as well as the creation or modification of DLL files within the system print spool drivers directory by processes other than spoolsv.exe. This activity is often associated with privilege escalation and persistence techniques involving print spooler service abuse.
Detects modification of scripts in extension folders.
This rule detects the creation or modification of generic executable files (e.g., 'me.exe', 'update.exe') within the Hola installation directory. It specifically looks for executables whose names match common updater or service patterns and whose process command line includes 'hola', 'update', or 'installer'. This activity could indicate a compromised delivery pipeline or supply chain attack, as observed with the Hola browser.
Detects the use of PowerShell commands that modify file system metadata (e.g., CreationTime, LastWriteTime, LastAccessTime). This technique, often referred to as 'timestomping', is used by adversaries to manipulate file timestamps to evade detection or hide activity.
Detects the use of attrib.exe with the '+h' flag to hide files or directories within common user-specific folders such as AppData, Temp, or Roaming. This activity is often associated with adversaries attempting to conceal their presence or malicious files.
Detects the creation or modification of suspicious macOS Launch Agents or Launch Daemons, specifically looking for patterns associated with the 'macOS.Gaslight' malware (e.g., 'com.apple.system.services.activity') or the creation of Launch Agents in user directories by processes masquerading as browser renderers (indicated by '--type=renderer' in the command line, excluding legitimate browsers). This rule aims to identify persistence mechanisms used by malware.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
This rule detects various activities associated with the SilverFox loader chain, including Defender exclusion modifications, suspicious child processes spawned from trojanized OEM binaries, VirtuOne DLL loading, scheduled task creation with specific names or unusual principals, creation of 'checktime.vbs' in public user directories, and masquerading of 'svchost.exe' in the Windows directory.
Detects StealC malware injecting into suspended chrome.exe or msedge.exe processes via APC injection to bypass Chromium App-Bound Encryption. The detection is correlated with the creation or modification of an IPC output file in C:\ProgramData\ with a specific naming convention (<HWID>.txt).
Detects attempts to restore or extract files containing path traversal characters ('../' or '..\') commonly associated with the ZipSlip vulnerability. This technique was utilized in Operation Escaneo (via the mkzip34.py tool) to deploy webshells automatically upon legitimate archive restoration. The rule specifically looks for file creation or modification events where the initiating process is a common archive extraction tool (unzip, tar) or a Java application server (java, tomcat), the file extension is for a Java web application (.jsp, .jspx), and the resulting folder path contains path traversal sequences.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
Page 84 of 109