Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects potential persistence and execution of suspicious VBScript files ('Telegram_Private_Call_Session.vbs' or 'assurance.vbs'). It monitors for the creation or modification of these files within the Windows Startup folder, their execution via wscript.exe, and the creation of corresponding registry entries to ensure automatic startup.
Detects execution of the Prinz Eugen ransomware 'servertool.exe' accompanied by high-volume file modifications targeting files with the '.prinzeugen' extension. This behavior is indicative of the ransomware's file encryption process, specifically its file system traversal and modification-time sorting strategy used to prioritize recently modified files for encryption.
Detects the creation or modification of a specific log file at AppData\Roaming\DT\logs.dat on Windows systems, a known indicator of behavior associated with the Remcos Remote Access Trojan (RAT) for capturing and storing keystrokes.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
Detects the VSPMsg print processor path and DLL name, which is associated with the SprySocks malware for persistence on Windows systems. The rule looks for specific strings related to the DLL name, print processor path, and common installation directories used by this malware.
This rule detects the creation or modification of executable files (.exe) within the 'AppData\Roaming' directory, excluding common legitimate application subfolders (Microsoft, Adobe, Mozilla, Skype, Notepad++). The detection is further refined by correlating these file events with processes that have specific version information (FileDescription, OriginalFileName, or ProductName) matching 'TuglaInsaatci' or 'oacY.exe'. This pattern is indicative of potential malware or unwanted applications attempting to establish persistence or execute from user-specific application data folders.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects instances where non-browser processes access sensitive browser-related files (Login Data, Cookies, or Local State) located within AppData directories. This behavior is highly indicative of credential and session token theft, often associated with AiTM or post-compromise information harvesting activities.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
This rule identifies potential ransomware activity by detecting a process performing a high volume of file rename or modification operations within a short time window. It specifically targets files with known ransomware extensions or those using randomized 6-8 character alphanumeric extensions, while excluding common administrative, backup, and temporary file operations performed by trusted software.
Detects the creation, modification, or renaming of a JSP file within the 'PSEMHUB.war' directory. This activity can indicate the deployment of a web shell or other malicious code within the PeopleSoft PSEMHUB web application, often associated with server compromise.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Detects the installation of Meow RAT persistence mechanisms on macOS by monitoring for the creation or modification of specific LaunchAgent or LaunchDaemon .plist files, particularly those named 'com.apple.accountsd.plist', and subsequent 'launchctl load' commands for these files. This rule identifies attempts to establish persistence by masquerading as legitimate system processes.
Detects the core payload components dropped by the malicious easy-day-js npm package, which is an infostealer affecting developers and CI/CD environments. The rule specifically looks for the creation or modification of 'protocal.cjs' and 'config.json' within a hidden 'NodePackages' directory located in 'C:\ProgramData\', a technique used to masquerade as legitimate Node.js tooling.
Detects modifications to the .vscode/extensions.json file which may be used by attackers to recommend malicious extensions to victims opening the workspace. Attackers can abuse this in conjunction with automated keystrokes to bypass warnings and force extension installations.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Detects the MYRA RAT (Operation Friday Harvest) establishing persistence by creating systemd user services disguised as legitimate system daemons (colord, haveged) under ~/.config/systemd/user/, enabling the service via systemctl --user enable, and dropping binaries to ~/.local/bin/. Also covers related persistence artifacts including /usr/local/lib/.libcache.so and /etc/profile.d/.sh.local. The rule also identifies node or node.exe spawning systemctl with the --user flag.
Page 87 of 109