Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects exploitation of weak installer file permissions
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects network traffic containing the string ".bashrc" on TCP port 22 (SSH). This could indicate an attempt to modify a user's shell profile for persistence, as .bashrc is a common file used to configure the Bash shell environment and can be leveraged by attackers to execute malicious commands upon login.
This rule detects network traffic over SMB (port 445) containing the string "SCRNSAVE.EXE" in a case-insensitive manner. This is indicative of a potential persistence mechanism where the screensaver executable has been replaced with a malicious one, and its name is being transmitted over the network, possibly during file transfer or command and control activities. The rule specifically looks for traffic flowing to the server on an established connection.
This rule detects attempts to modify the SSH daemon configuration file (sshd_config) remotely over an established TCP connection to port 22. The detection is based on the presence of the string "sshd_config" within the network flow, indicating potential remote manipulation of SSH authentication settings.
This rule detects attempts to write or modify cron persistence entries via HTTP. Specifically, it looks for HTTP client body content containing the string "/etc/cron" (case-insensitive). This indicates a potential attacker trying to establish persistence on a Linux system by scheduling malicious tasks.
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
This rule detects potential ransomware activity by identifying rapid bulk file modifications or renames that result in files adopting extensions commonly associated with ransomware encryption. It looks for a high volume of file events (creation, modification, rename) within a short timeframe (1 hour) where the new file extensions match a predefined list of ransomware-specific extensions.
This rule detects the creation, modification, or renaming of files associated with PCPJack/TeamPCP malware on Linux systems. It specifically looks for these activities in common temporary directories (`/tmp/`, `/dev/shm/`, `/var/tmp/`) and for files with names matching known PCPJack/TeamPCP artifacts (e.g., `pcpcat`, `teampcp`, `xmrig`, `proxy.sh`, `kube.py`, `.pcpx`, `.pcp`) or hidden files (starting with a dot). This activity often indicates the initial staging or persistence mechanisms of the malware.
This rule detects attempts to modify web server files, specifically 'index.html' within a 'wwwroot' directory, over the Server Message Block (SMB) protocol. The detection is based on the presence of these strings in network traffic directed to port 445 (SMB) on the internal network. This activity could indicate an attacker attempting to deface a web server or inject malicious code.
This rule flags a large number of files receiving a '.lalia' extension at once, indicating potential Lalia ransomware activity. Bulk extension changes are a common initial indicator of ransomware infection. The rule looks for at least 20 file events (renamed, created, or modified) where the file name ends with '.lalia' within a 30-day window.
Monitors for network connections originating from the VSCode extension host process to GitHub API endpoints immediately following a new extension installation. This may indicate token exfiltration or repository enumeration from a malicious extension.
Detects modification of Linux RC initialization scripts for persistent execution
Detects modification of LNK shortcut files in startup folders for autostart persistence
Detects the creation or modification of a VSCode package.json file that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting the 'skipPublisherTrust' flag to true. This technique can be used by adversaries to install malicious VSCode extensions without publisher trust checks, potentially leading to supply chain compromise or defense evasion.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
This rule detects the staging (creation, modification, or renaming) and subsequent execution of executable files (.exe) within the 'C:\Users\Public\Music\' directory. This folder is an unusual location for executables and is often leveraged by adversaries for staging malicious payloads to evade detection. The rule specifically references 'Grixba' and 'Play Ransomware' in its context, suggesting it targets behaviors associated with these threats.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
Detects Hero proxyware artifacts being written or modified within the Windows SysWOW64 directory. Presence of these files may indicate installation of unauthorized proxy services or abuse of enterprise endpoints for traffic relaying.
This rule detects network traffic containing the string "/etc/sudoers" over TCP port 22 (SSH). This could indicate an attempt to modify the sudoers file for privilege escalation, as the sudoers file controls which users can execute commands with superuser privileges.
Page 92 of 109