Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the creation or manipulation of the specific archive file (tpcp.tar.gz) used by TeamPCP to bundle stolen credentials. This rule monitors command line activity, cloud process execution, and file system events for references to 'tpcp.tar.gz'.
Detects the creation or modification of files within the misspelled 'Photoes' directory (e.g., \ProgramData\Photoes\). This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger for storing keystroke log files.
Detects the creation or modification of files within the misspelled 'Photoes' directory (e.g., \ProgramData\Photoes\). This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger for storing keystroke log files.
Detects the creation or modification of .NET application configuration files (`.exe.config`) in sensitive framework directories. This is a technique known as AppDomain Hijacking, used by the Silver Dragon APT group to hijack legitimate Windows services like `dfsvc.exe` and `tzsync.exe` for persistence and to load their malware (MonikerLoader).
High-fidelity correlation detecting DPRK Contagious Trader npm malware persistence: Node.js process modifying authorized_keys followed by ufw allowing SSH. Targets cryptocurrency traders via poisoned GitHub trading bot repositories.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Detects the creation or modification of "app.asar" files, which are archives used by Electron-based applications. Adversaries can replace this file in a legitimate, signed application to execute malicious code, as seen in a recent ClickFix campaign trojanizing the WorkFlowy application.
This rule set detects components of the StegaBin supply-chain attack targeting npm packages. The first rule, 'stegabin_npm_loader', identifies malicious JavaScript loaders that utilize Pastebin for steganography and Vercel API paths for command and control. It looks for specific strings indicating Pastebin usage, Vercel API endpoints, and unique markers related to the steganographic decoding or payload. The second rule, 'StegaBin_VSCode_Tasks_Persistence', focuses on persistence mechanisms within VSCode's tasks.json files. It detects configurations that automatically execute malicious code upon folder opening, specifically looking for the 'runOn': 'folderOpen' property and references to the 'ext-checkdin.vercel.app' domain and associated API paths. Together, these rules aim to identify both the initial loader and the persistence mechanism used by the StegaBin campaign.
This rule detects files associated with two distinct malware chains, ShellFolder and LOTUSLITE, which have been observed in campaigns leveraging Middle East conflict themes as bait. The ShellFolder chain detection focuses on specific file names like 'ShellFolder.exe', 'ShellFolderDepend.dll', and 'BaiNetdisk', along with a unique decryption key '20260301@@@'. The LOTUSLITE downloader chain detection identifies specific DLLs ('libmemobook.dll', 'kugou.dll'), folder paths ('C:\ProgramData\CClipboardCm\', 'C:\ProgramData\WebFeatures\'), executable names ('WebFeatures.exe'), and hardcoded URLs/IP addresses ('www.e-kflower.com', '172.81.60.97') used for persistence and downloading next-stage malware. The rule aims to identify concrete indicators of compromise rather than broad patterns, focusing on the specific artifacts reported in related threat intelligence.
Detects malicious Message of the Day scripts for persistence
Detects the creation or modification of udev rules that execute suspicious commands or scripts from unusual locations. Udev rules are used by the Linux kernel device manager to handle hardware events and can be abused for persistence.
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
Detects the command-line pattern of reassembling a ZIP or CAB file from fragmented parts using the 'copy' command. This technique was observed in a campaign where adversaries manually reconstructed payloads on disk to evade detection by splitting them into multiple parts and then reassembling them.
Monitors for command-line activity indicating the addition of SSH keys to authorized_keys files or the modification of the SSH daemon configuration to permit root login on Cisco SD-WAN devices. This is a common persistence technique used by attackers after gaining initial access, such as through CVE-2026-20127.
Detects the creation or modification of Python scripts in the /unitree/etc/programming/ directory on Unitree Go2 robots. This activity is a strong indicator of exploitation of CVE-2026-27509 or CVE-2026-27510, where an attacker uploads a malicious script for remote code execution.
This rule detects when a process, potentially a Go-compiled binary (indicated by 'go' in the command line), establishes persistence by creating or modifying a registry run key or by dropping a file in a startup folder. This behavior is associated with the Moonrise RAT.
Detects the creation or modification of a Claude Code settings file (`.claude/settings.json`). This file can be configured to automatically approve Model Context Protocol (MCP) servers by setting `enableAllProjectMcpServers` to `true` or by using `enabledMcpjsonServers`. This bypasses security prompts designed to warn users about potential command execution, which can lead to Remote Code Execution (RCE) as described in CVE-2025-59536.
Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.
This rule detects files by their SHA256 hash that are known to be associated with the exploitation of CVE-2026-1731. This includes payloads such as SparkRAT, VShell, and various web shells and droppers.
Detects the presence of the unique 'ic-tracker-js' ID within script tags on web server files (.php, .html, .js), which is a high-fidelity indicator of a compromised WordPress site by the IClickFix framework. This rule looks for file creation or modification events where the initiating process command line contains the malicious string.
This rule set detects indicators of compromise associated with the RESURGE activity targeting Ivanti Connect Secure devices, as described by CISA. It looks for specific file hashes, the presence of a covert socket path (.logsrv), and modifications to key Ivanti filesystem artifacts such as LD_PRELOAD, DSUpgrade.pm, coreboot.img, and scanner.py. A match indicates potential compromise and requires further investigation to confirm the asset role, timing of file appearance, and comparison with approved maintenance windows. If hits are found, collect logs and file copies, reduce external exposure, and look for unusual activity like unexpected administrator actions or unfamiliar outbound connections.
Page 99 of 109