Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
129 detections
Filters
Last updated
All Time
Detection languages
91
14
8
8
6
Contributors
27
21
12
10
8
Categories
57
43
28
23
18
Platforms
106
16
10
2
2
Products / Services
63
11
7
5
4
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
1
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
Detects suspicious file downloads from the internet where common DLLs (wininet.dll, urlmon.dll, msxml3.dll) are initiating the file creation of executable, DLL, PowerShell, or batch files. The rule specifically looks for scenarios where 5 or more such files are created by the same initiating process on a device, indicating potential malicious activity like ingress tool transfer.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
Detects known malicious invoice PDFs and email samples used in Crimson Kingsnake campaigns.
Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.
Detects the creation of hidden tracking files (.pkg_history and .pkg_logs) in the system's temporary directory. These markers are dropped by the setup.cjs dropper as part of the easy-day-js typosquat in the Mastra npm supply chain compromise.
Detects when a file is renamed to have the suffix ':payload' and the initiating process's file name is the same as the previous file name. This behavior can be indicative of Payload Ransomware to hide or modify files.
Detects known malicious invoice PDFs and email samples used in Crimson Kingsnake campaigns.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects when a file is renamed to have the suffix ':payload' and the initiating process's file name is the same as the previous file name. This behavior can be indicative of Payload Ransomware to hide or modify files.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule aggregates these file events by device and time, triggering an alert if 10 or more such files are observed within an hour on a single device, indicating a bulk encryption event.
Detects the creation, modification, or renaming of files with the '.prinzeugen' extension, which is commonly associated with ransomware activity. The rule aggregates these events by device and time, alerting if 10 or more such files are observed within an hour, indicating potential widespread encryption.
Detects the creation of PwCWSP64.dll, a malicious network or Winsock Service Provider component dropped by Makop ransomware.
Page 1 of 7