Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
This rule detects potentially unauthorized access or attempts to copy sensitive SSH keys (e.g., id_rsa, id_ed25519) by command-line utilities (such as cat, cp, tar, scp, or curl) or when triggered by automation-related process names like 'terraform'. It monitors both process command lines and file events to identify staging or exfiltration activities.
Detects the creation or modification of specific files within the /tmp directory, specifically those matching naming patterns associated with 'jasper-log' files or temporary pipe files. These patterns are often associated with temporary storage or data staging activities during post-exploitation or malware execution.
Detects technique used by MAZE ransomware to enumerate directories using Powershell
Detects file system operations targeting common user directories and specific file extensions (.bak, .backup, .locked) often associated with data exfiltration, staging, or ransomware activity.
This rule detects potential web shell activity by identifying suspicious PHP file creation within Magento-style product cache directories and the execution of find commands targeted at searching for PHP files in the web directory. This behavior is indicative of an attacker attempting to plant a web shell and subsequently enumerating web files for further exploitation.
Detects the creation or modification of specific files within the /tmp directory, specifically those matching naming patterns associated with 'jasper-log' files or temporary pipe files. These patterns are often associated with temporary storage or data staging activities during post-exploitation or malware execution.
Detects the presence of GoCaracal, a Go-based Remote Access Trojan (RAT) attributed to the Dark Caracal threat group, based on unique strings and function names indicative of its implant capabilities, including shellcode injection and system discovery.
Detects access attempts to sensitive files such as xmlrpc.php, .htaccess, wp-config.php, /etc/shadow.
Detects bulk file enumeration/access across multiple users' virtual desktop profile shares via a compromised root DFS drive, which CISA's red team used to read local files of all users regardless of active session.
Detects requests for files with names suggesting sensitive content (password, secret, apikey, etc.).
This rule detects common command-line utilities (cat, bash, sh, python, grep) being used to access the '/proc/1/environ' file. This file contains environment variables for the PID 1 process (typically the init system), which may include sensitive information such as credentials, configuration paths, or system secrets.
Detects the execution of Windowsupdate.exe, a known component of the QUICSILVER campaign. The backdoor is identified by its filename and specific file hash. Once executed, it facilitates system and directory discovery, including hostname enumeration and file system navigation.
Detects access attempts to application/error/debug log files.
Detects at least 3 distinct C2Looper-associated discovery commands (ipconfig /all, whoami /all, nltest /dclist, net group /domain "domain admins"/"domain computers", wmic product get name,version, ls, drives) executed by the same parent process within a 60 second window, reducing false positives from isolated legitimate admin usage of any single command.
Detects processes attempting to interact with multiple browser binaries (chrome.exe or msedge.exe) across different standard application directories within a short time window. This behavior often indicates an adversary or malicious script probing for specific installed browsers to facilitate credential harvesting, configuration dumping, or session hijacking.
Detects the execution of commands 'ls' or 'drives' via command line, which are often used by threat actors for reconnaissance and file/directory enumeration on a compromised host.
Detects at least 3 distinct C2Looper-associated discovery commands (ipconfig /all, whoami /all, nltest /dclist, net group /domain "domain admins"/"domain computers", wmic product get name,version) executed by the same parent process within a 60 second window, reducing false positives from isolated legitimate admin usage of any single command.
Detects a filtered document sweep of Desktop, Documents, and Downloads by sensitive file extensions (including wallet and key files) performed by a single non-standard process, matching AmnesiaStealer's document harvesting routine.
Detects unusually high-volume recursive file/directory enumeration (dir /s, tree, Get-ChildItem -Recurse) spanning multiple distinct user-profile directories or department shares in a short window, excluding known AV/EDR scanning engines and backup-agent processes.
Detects NightLedger Command 75, which enumerates logical drives as a pre-exfiltration reconnaissance step; identifying available storage volumes before staging and uploading data via Command 70 (POST to C2). The query hunts for drive enumeration commands (WMIC, fsutil, PowerShell variants) spawned specifically from the DLL-loader process class associated with NightLedger's execution chain. Drive enumeration from rundll32, regsvr32, AppVShNotify.exe, or dllhost has no legitimate use case and is high-confidence in this parent-process context.
This rule detects activities associated with the SHub Stealer malware on macOS, specifically identifying the creation of staging directories in /tmp (named /tmp/shub_<id>/*), the presence of a 'FileGrabber' sub-directory, and unauthorized file access to common cryptocurrency wallet applications like Electrum, Exodus, Trezor Suite, Ledger Live, Sparrow, and Guarda. It filters out common administrative or installer tools to reduce noise.
Page 7 of 31