Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects anomalous activity associated with the RoguePlanet (CVE-2026-50656) exploit. The rule identifies suspicious file operations by MsMpEng.exe within temporary staging directories (RP_<UUID>), execution of non-Microsoft signed binaries from these staging paths, and unexpected file activity involving 'wdtest_temp' paths, which are indicative of an NTFS junction swap exploit sequence.
Detects the execution of wermgr.exe from a non-standard directory, specifically targeting the RoguePlanet junction-hijacking technique where the Windows Error Reporting process is replaced by an attacker-controlled binary under a staging path (e.g., %TEMP%\RP_*).
Detects signs of the VerdantBamboo threat actor's BRICKSTORM/PLENET campaign, specifically targeting Linux-based edge appliances like pfSense and Synology NAS. The rule monitors for sudo abuse by specific service accounts (e.g., egnyteservice, www-data) attempting to leverage NOPASSWD sudo privileges for the 'tee' utility to write malicious content into sensitive system files (e.g., /usr/sbin/, /etc/cron.d/, /etc/sudoers). Additionally, it identifies unauthorized sudo enumeration commands that may indicate early-stage reconnaissance or persistence efforts.
This rule detects suspicious activity associated with potential threat actor staging patterns, specifically monitoring for the usage of temporary directories like 'wdtest_temp', file path manipulation involving 'RP_*' (often related to shadow copy or system restore point paths), and the execution of 'wermgr.exe' from non-standard locations. It also identifies non-SYSTEM processes attempting to enumerate Volume Shadow Copy Service (VSS) devices using commands like 'NtQueryDirectoryObject' or referencing 'HarddiskVolumeShadowCopy'.
Detects the execution and download of the 'isp.sh' shell dropper and the 'lambsys' Go-based cryptominer binary on Linux systems. This rule monitors for common dropper patterns, including shell execution of piped commands, use of curl/wget to fetch known malicious components, and instances where Langflow processes attempt to spawn shell-related child processes for potential payload execution.
Detects host fingerprinting and geolocation activity performed by the Lambsys/procq cryptominer. The rule identifies processes like curl or wget querying external IP intelligence services (ipinfo.io, ip-api.com) when associated with suspicious binary paths or spawned by known miner processes.
Detects the Yuta/Solara .NET WPF dropper (SLaunch.exe) executing the staging phase of a PyInstaller-compiled Python stealer (winupdate.exe) into the %APPDATA%\.cache directory, as observed in the Glove Stealer campaign.
Detects suspicious child processes (such as PowerShell, CMD, or WScript) being spawned by Microsoft Office applications or email clients, which is indicative of exploitation activity consistent with Gamaredon spear-phishing campaigns. This specifically monitors for execution patterns attempting to deploy 'Ptero' family implants potentially following exploitation of vulnerabilities such as CVE-2025-8088.
This rule detects the execution of Quick Assist (quickassist.exe) or Microsoft Remote Assistance (msra.exe) in scenarios where the parent process, causality chain, or command line includes references to Microsoft Teams. This behavior is indicative of social engineering attempts where attackers impersonate IT support via Teams to induce users to launch remote access tools, a tactic observed in campaigns like BlackBasta.
Detects the execution of known remote access tools (e.g., AnyDesk, SyncFuture) or processes originating from common user-writable directories (AppData, Temp, Local) that subsequently spawn other processes within these same user-writable directories. This pattern is commonly observed in malware staging or the misuse of remote support tools for unauthorized access.
This rule monitors for two high-confidence indicators of malicious activity: the execution of known Payouts King ransomware binaries and the termination of security software processes by non-system actors, which is indicative of defensive evasion techniques such as syscall abuse.
Detects the execution of QEMU processes, the presence of suspicious virtual disk files (e.g., .qcow2, .db) in unexpected locations, and the installation of Virtio drivers. These patterns may indicate an adversary is deploying hidden virtual machines to bypass host-based security controls.
Detects potential privilege escalation activity including manual privilege discovery using 'whoami /priv', suspicious elevated processes spawned from non-elevated parents, and specific scheduled task execution patterns associated with Payouts King malware.
Detects the use of native Windows administration and system tools commonly used for reconnaissance and discovery of running processes, domain controllers, and system configuration.
Detects the execution of various suspicious file types (executable, scripts, shortcuts) from common Windows temporary directories (AppData\Local\Temp and Windows\Temp). The rule excludes common installers and binaries signed by reputable software publishers to reduce noise.
Detects evidence of malware, specifically TA4922 (Atlas RAT, RomulusLoader), attempting to evade sandbox or virtualization environments. The detection monitors process command lines for WMI queries or registry artifact paths related to known hypervisor technologies such as VMware, VirtualBox, and QEMU. It requires multiple occurrences within a 5-minute window to reduce potential noise.
Detects the execution of remote monitoring and management (RMM) binaries AnyDesk or SyncFuture when launched by suspicious parent processes commonly associated with phishing delivery chains (e.g., mshta, wscript, cmd, powershell), or when executed from user-writable directories like Temp or AppData, which is a common pattern for persistent remote access abuse.
Detects execution patterns associated with the BQTLock ransomware, specifically the PyInstaller-packaged 'start.exe' binary acting as a loader to spawn 'BQT.exe' or other child processes, identified by specific PyInstaller environment artifacts in the command line.
This rule detects the BQTlock ransomware behavior of capturing desktop screenshots using suspected malicious processes ('BQT.exe', 'start.exe') and attempting to exfiltrate the captured data via the Telegram API using 'sendPhoto' or 'sendDocument' commands.
Detects command-line activity searching for, accessing, or displaying sensitive credential and configuration files on Linux systems, such as AWS credentials, Kubernetes configurations, Docker settings, or application API keys. This behavior is indicative of credential theft or discovery attempts.
Detects the execution of system information discovery utilities (systeminfo, ipconfig, whoami, net) by specific process names (BQT.exe or start.exe), followed by a DNS request to api.telegram.org within a 30-minute window. This behavior is indicative of malware performing reconnaissance and using Telegram for command and control or data exfiltration.
Page 385 of 977