Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects anomalous file modification or deletion events targeting the SSH known_hosts file. This activity can be indicative of VECT ransomware, which zeroes out this file across compromised Linux and ESXi systems to suppress host-key warnings, enabling silent lateral movement via SCP and SSH.
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
This rule detects attempts to modify GRUB configuration files using common text editors. Adversaries may modify GRUB configuration to establish persistence, disable security features, or alter the boot process for malicious purposes.
This rule detects the presence of suspicious script content (e.g., 'system(', 'exec(', '/dev/tcp/') within Python (.py) or shell (.sh) files located in common plugin directories on Linux systems. This could indicate an attempt to inject malicious code into package management configurations for persistence or privilege escalation.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory, indicative of automated task deployment via Group Policy Preferences (GPP) commonly abused by adversaries. This activity can be used for persistence, privilege escalation, or lateral movement.
Detects file creation or modification events targeting /etc/systemd/system/persist.service, or the execution of 'systemctl enable persist'. This persistence mechanism is used by the Nexcorium Mirai variant to ensure the botnet survives reboots.
This rule detects the staging or execution of the LaxGopher payload, disguised as 'whisper.dll', by monitoring DLL loading and file writing events. It specifically looks for the filename 'whisper.dll' in ImageModuleLoad, PeFileWritten, or NewExecutableWritten events.
This rule detects the execution of the 'strip' utility on Linux systems, when it is used on a file located in common temporary directories or user home directories. Adversaries may use 'strip' to remove symbols from compiled binaries, making reverse engineering more difficult and potentially reducing file size, which can aid in obfuscation or evasion.
Detects attempts to modify file timestamps on Linux systems using the 'touch' command with the '-r' or '--reference' flags. This technique, known as timestomping, allows adversaries to change the access and modification times of a file to match those of another file, to evade detection or blend malicious files with legitimate ones.
This rule detects attempts to mount a bind from a temporary directory or other sensitive system directories on Linux systems. This behavior can be indicative of an attacker trying to hide malicious activity or gain persistence by mounting a bind from a compromised location to a system directory.
Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.
Detects log file modification followed by service manipulation to cover tracks.
Used /dev/null, therefore it acts as a stronger version of disable
Used /dev/null, therefore it acts as a stronger version of disable
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
This rule detects attempts to modify the SSH authorized_keys file, which can be used by adversaries to maintain persistence on a compromised system, using common utilities like echo, tee, cp, mv, python, or perl.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.
This rule detects file creation, modification, or renaming events related to 'TieringEngineService.exe' in the 'C:\Windows\system32\' directory, or process execution of 'TieringEngineService.exe' running as the 'SYSTEM' account. This activity could indicate suspicious system-level operations or potential abuse of a legitimate Windows component.
Detects appending of zip file to image
Detects non-Defender processes accessing the Windows Defender signature definition file (mpasbase.vdm). This file should exclusively be accessed by Defender platform processes (MsMpEng.exe, MpCmdRun.exe, NisSrv.exe, etc.) and Windows servicing components. Any other process touching this file has zero legitimate use cases and is a high-fidelity indicator of the BlueHammer zero-day LPE exploit, which leverages a batch oplock on mpasbase.vdm to freeze Defender mid-read, then performs NTFS junction swapping to redirect SYSTEM-context reads to the SAM hive via a VSS snapshot, resulting in local credential theft and privilege escalation. MITRE: T1068 - Exploitation for Privilege Escalation. References: https://github.com/Nightmare-Eclipse/BlueHammer, https://www.deobfuscated.dev/posts/defender-lpe-0-day
Detect file time attribute change to hide new or changes to existing files.
Page 97 of 109