Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detect changes in auditd configuration files
Detects the ld.so preload persistence file. See `man ld.so` for more information.
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
This rule detect using dd and truncate to add a junk data to file.
This rule detect using dd and truncate to add a junk data to file.
Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.
Detect changes of syslog daemons configuration files
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
This rule detects the creation, modification, or renaming of directories related to the malicious 'plain-crypto-js' npm package within a 'node_modules' folder. This activity is indicative of a supply chain compromise where a legitimate package (Axios) was found to include this malicious dependency.
This rule detects the creation, writing, or renaming of specific files associated with the compromised Axios npm package versions 1.14.1 and 0.30.4. Upon installation, the postinstall script of these compromised packages deploys dropper scripts to download and install a remote access trojan on Mac, Linux, or Windows endpoints. The rule specifically looks for file paths indicative of these dropper activities across different operating systems.
Detects network connections to malicious domains, associated IPs, execution of related malicious file hashes, registry persistence, and postinstall script executions related to UNC1069 NPM/Axios supply chain attacks deploying SILKBELL and WAVESHAPER.V2. Categorized into risk-scored scenarios.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
This rule detects suspicious modifications or creations of Linux login log files (wtmp, btmp, utmp, lastlog, utmpx, wtmpx) by processes that are not legitimate system processes typically associated with managing these logs. Adversaries may modify or clear these logs to hide their presence on a system or to manipulate login records.
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
This rule detects the forced removal of legitimate cryptocurrency wallet applications (Ledger Wallet, Trezor Suite, Exodus) followed by the extraction of new applications into the /Applications directory on macOS. It also looks for chmod commands to make the new applications executable and attempts to download suspicious zip files from 'wusetail.com'. This activity is indicative of the AMOS malware campaign, which aims to replace legitimate wallet applications with trojanized versions to steal cryptocurrency.
This query hunts for .lnk (shortcut) files that are either newly created or have the hidden attribute set, located in common Windows startup folders. Attackers often place LNK files in these locations to establish persistence.
Detects file creation, modification, or execution events involving the path '/Library/Caches/com.apple.act.mond', which is the hardcoded drop location for the macOS C++ RAT deployed by the Axios supply chain attack.
This query hunts for .lnk (shortcut) files that are either newly created or have the hidden attribute set, located in common Windows startup folders. Attackers often place LNK files in these locations to establish persistence.
Detects the creation of a file named "msbuild.exe" within the Windows Startup folder. This behavior matches the persistence and masquerading techniques used by the TeamPCP threat actor following the compromise of the telnyx PyPI package.
Detects the creation or modification of .plist files on macOS systems. This activity can be indicative of various malicious behaviors, particularly those related to persistence or privilege escalation, as .plist files are often used to configure application settings, launch agents, or other system behaviors.
This rule detects artifacts associated with the Auto-Color Linux backdoor. Specifically, it looks for the presence of the malicious library 'libcext.so.2', which mimics a legitimate library, or modifications to '/etc/ld.preload' for persistence and dynamic linker hijacking. It also identifies specific file paths used by the malware, such as '/var/log/cross/auto-color' or files within '/tmp/cross/' with a 'config-err-' prefix.
High-fidelity correlation detecting DPRK Contagious Trader npm malware persistence: Node.js process modifying authorized_keys followed by ufw allowing SSH. Targets cryptocurrency traders via poisoned GitHub trading bot repositories.
Page 98 of 109