Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Identifies developers or CI pipelines executing the hijacked @bitwarden/cli npm package (v2026.4.0) during the exposure window.
Detects the execution of a scheduled task named OneDriveHealth invoking taskkill on explorer.exe to trigger a hijacked COM object. This rule specifically looks for 'svchost.exe' as the initiating process, executing 'taskkill' with 'explorer.exe' in its command line, which is indicative of a specific attack chain involving scheduled tasks and process termination.
Detects behavior indicative of StealC or Amadey malware loading and executing in-memory by injecting code into trusted Windows system processes such as svchost.exe or explorer.exe. The rule correlates a process launch from suspicious locations like Temp or AppData with subsequent process access events targeting these host processes, typically signaling process injection for evasion.
Detects a process creating a Windows named event object that follows the specific naming convention of StealC malware (computer_name_username). This technique is used by the malware as an instance mutex to prevent multiple concurrent executions on the same host.
Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.
This rule detects the execution of cloud transfer tools such as rclone, WinSCP, Dropbox, OneDrive, or curl.exe when their command line arguments indicate the transfer of mailbox-related files (PST, OST, or temporary files with 'ts_' prefix) and include keywords like 'copy', 'sync', 'put', 'upload', or 'transfer'. The rule focuses on the causality chain to identify the actor and processes involved in such activities, which could indicate data exfiltration.
Security Driver and Service Enumeration
Cortex XDR
This rule detects attempts to enumerate security-related drivers and services, specifically targeting ESET, Npcap, NPF, and Sysmon components. It looks for command-line utilities like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' being used with specific driver/service names. The XQL view includes actor and causality fields for investigation.
Gamaredon hides directories and replaces them with LNK files on removable media.
Detects removal and replacement of Chrome.app on macOS to bypass Manifest V3.
Detects the Bomgar process piping the output of a command shell directly into a network socket, establishing an interactive reverse shell. This often indicates exploitation of a Bomgar vulnerability.
Detects the creation of a Windows Service pointing to a suspected Komari agent binary in a non-standard directory (Public, ProgramData, or Temp) to survive reboots. This rule specifically looks for 'sc.exe' being used with the 'create' command and a 'binPath' argument that includes one of the specified directories and ends with '.exe'.
This rule detects the download of a standalone Python build for Apple Darwin from astral-sh/python-build-standalone on GitHub using 'curl', followed by its extraction using 'tar'. This activity could indicate a developer setting up a specific Python environment or potentially a malicious actor introducing a custom Python interpreter.
Detects activity associated with the macOS.Gaslight credential stealer, specifically focusing on Python processes accessing the login.keychain-db, browser credential stores, creating a 'collected_data.zip' archive, and executing security or reconnaissance commands. This rule identifies file events (creation, modification, read, copy) related to keychain and archive staging, as well as process events involving the 'security' command for password extraction and 'ps' or 'system_profiler' for system reconnaissance, all initiated by Python.
Detects the SilverFox loader performing sandbox and virtual machine evasion checks, including process enumeration (CreateToolhelp32Snapshot), heap pressure via VirtualAllocExNuma, and timing checks (QueryPerformanceCounter, NtAllocateVirtualMemoryApiCall). The detection focuses on specific process names and file paths associated with trojanized Panasonic/Philips OEM process contexts.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
This rule detects attempts to enumerate keyboard input sources or search for Russian keyboard layouts on macOS systems. This activity can be indicative of an adversary performing a 'geofence' check to determine the system's locale or origin, potentially to avoid targeting specific regions.
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
This rule detects the COM activation of 'Windows.Internal.InstallService.Control.InstallServiceControl' by non-SYSTEM processes, which can be abused to invoke 'CreateInstallServiceWork' for UNC-based DLL coercion. It looks for specific strings in process command lines and additional fields in device events, as well as suspicious loading of 'combase.dll' by non-system processes.
Detects the execution or file events related to 'ugate.exe' when it is located in the 'C:\Users\Public\Documents\' folder or its subfolders. This location is often used by malware for persistence or staging.
Detects reconnaissance activities characteristic of StealC malware, specifically the enumeration of running processes using 'tasklist.exe' and discovery of installed software by querying Uninstall registry keys. The detection focuses on these activities originating from suspicious user-writable directories like AppData, Temp, or ProgramData, which are often used by malware for execution.
Correlates the stealer invoking system_profiler to search for virtualization or security strings (e.g., VMware, Parallels) to halt execution in sandboxes.
Page 56 of 84