Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Detects a shell script containing 'fanout' in its name, created or modified in common temporary directories like /tmp or /var/tmp, matching a reported propagation workflow. This activity is indicative of lateral movement attempts.
This rule detects potentially malicious lateral movement or persistence activities by monitoring the creation or modification of executable files in remote network shares and startup folders, as well as the use of administrative tools like sc.exe or schtasks.exe to create services or tasks. The rule specifically filters out processes signed by Microsoft, focusing on non-standard or unsigned binaries that perform these administrative actions across multiple instances, indicating potential automated lateral propagation.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects the creation, modification, or renaming of the `authorized_keys` file within the `.ssh` directory by processes other than common SSH key management or shell utilities. This activity could indicate an adversary attempting to establish persistence or elevate privileges by adding their own public key for SSH access.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects the creation or modification of specific SharePoint policy pages DLL files (microsoft.office.policy.pages.dll) that are known to be vulnerable to CVE-2026-45454. The detection is based on matching the SHA256 hashes of these vulnerable DLL versions. This indicates the presence or manipulation of a vulnerable component within a SharePoint environment.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule aggregates these file events by device and time, triggering an alert if 10 or more such files are observed within an hour on a single device, indicating a bulk encryption event.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects the creation, modification, or renaming of files with the '.prinzeugen' extension, which is commonly associated with ransomware activity. The rule aggregates these events by device and time, alerting if 10 or more such files are observed within an hour, indicating potential widespread encryption.
This rule detects potential ransomware activity by identifying rapid bulk file modifications or renames that result in files adopting extensions commonly associated with ransomware encryption. It looks for a high volume of file events (creation, modification, rename) within a short timeframe (1 hour) where the new file extensions match a predefined list of ransomware-specific extensions.
This rule detects the execution of a specific command-line sequence involving 'cmd.exe' that is characteristic of the ClickFix attack. The sequence includes moving an 'update.zip' file from the user's downloads, extracting a 'u.zip' file in the temporary directory, and then executing 'update.bat'. This pattern is often associated with malicious copy-paste techniques.
Detects when a browser desktop shortcut (.lnk file) is modified by a setup or update executable, which could indicate a Potentially Unwanted Program (PUP) injecting malicious arguments or redirecting the browser to an attacker-controlled gateway upon launch.
This rule detects the execution of SharkLoader components, specifically identifying unauthorized SystemSettings.exe processes attempting to load malicious DLLs (e.g., SystemSettings.dll, DscCoreR.mui, SyncRes.dat) from locations outside of the legitimate C:\Windows\ImmersiveControlPanel\ directory. It also tracks the creation or modification of these payload files in common persistence directories like AppData or ProgramData.
Detects file creation and execution patterns associated with SharkLoader malware. The rule monitors for the staging of malicious DLLs, encrypted beacon payloads, and API hooks in specific AppData subdirectories ('xwreg' and 'xgdf'), as well as the execution of 'SystemSettings.exe' from non-standard locations, which mimics legitimate Windows system processes to achieve persistence and evasion.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Detects Pay2Key ransomware activity involving the extraction of suspicious DLLs into the Avast installation directory and the subsequent loading of these unsigned/unauthorized DLLs by legitimate Avast processes. This rule covers the file creation of known malicious DLL names, the use of 7za.exe for extraction into the directory, and the process module load events for unsigned DLLs within the Avast scope.
Detects activity associated with VILE ransomware where it modifies files within the Chrome extension locale directory (specifically for the extension nmmhkkegccagdldgiimedpiccmgmieda) by appending the .vile extension, indicating potential file encryption or tampering for impact.
Detects evidence of TrymeLocker or similar ransomware behavior by identifying the simultaneous use of Windows utilities (icacls, cacls, takeown, attrib) to modify permissions on critical system directories or obscure executables, correlated with the deletion of volume shadow copies or disabling of system recovery features.
Page 85 of 109