Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the use of the 'tar' utility with the '--use-compress-program' flag, where the compression program specified is not a standard system compression tool. This pattern is commonly used by attackers to execute arbitrary payloads when tar extracts malicious archives.
Detects the use of the 'tar' utility with the '--use-compress-program' flag, where the compression program specified is not a standard system compression tool. This pattern is commonly used by attackers to execute arbitrary payloads when tar extracts malicious archives.
Detects the use of the 'tar' utility with the '--use-compress-program' flag, where the compression program specified is not a standard system compression tool. This pattern is commonly used by attackers to execute arbitrary payloads when tar extracts malicious archives.
Detects the execution or invocation of processes matching a known list of malicious file hashes (SHA256). The rule monitors both direct execution (SHA256) and instances where a malicious file acts as an initiating process.
Detects the execution or invocation of processes matching a known list of malicious file hashes (SHA256). The rule monitors both direct execution (SHA256) and instances where a malicious file acts as an initiating process.
Detects execution or file presence of known malicious files based on a pre-defined list of SHA256 hashes associated with known threat activity.
Detects execution or file presence of known malicious files based on a pre-defined list of SHA256 hashes associated with known threat activity.
This rule monitors for process execution and file activity associated with a specific file hash known to be malicious. By tracking both process and file events using a SHA256 identifier, it captures when a specific threat artifact is executed or interacted with on a system.
This rule monitors for the execution of a process that matches a specific SHA256 file hash identified as malicious.
This rule detects the presence or execution of a specific CAB file identified by its SHA256 hash. It monitors both file creation/access events and process execution events involving this hash, indicating potential malicious activity involving a known malicious cabinet file.
Detects the execution or invocation of processes matching a known list of malicious file hashes (SHA256). The rule monitors both direct execution (SHA256) and instances where a malicious file acts as an initiating process.
Detects execution or file presence of known malicious files based on a pre-defined list of SHA256 hashes associated with known threat activity.
Detects Java-based Metasploit/Meterpreter payload files (.class/.jar) dropped post-exploitation, as observed following PaperCut RCE exploitation chain
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
Detects the presence of known file hashes associated with Vectra Remote Access Trojan (RAT). The rule monitors both file creation/existence events and process execution events where the SHA256 hash matches the identified indicators of compromise.
Detects the presence of known file hashes associated with Vectra Remote Access Trojan (RAT). The rule monitors both file creation/existence events and process execution events where the SHA256 hash matches the identified indicators of compromise.
Detects Adobe Acrobat (Acrobat.exe) launched by a suspicious parent process (GRrte.exe) while opening a specific PDF document from the user's temporary directory. This pattern is indicative of a potential malicious document lure often associated with malware delivery.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
Detects the installation or execution of known remote access tools (RMM) from suspicious parent processes (browsers, archives) or from user-writable directories (Temp, Downloads). This behavior is characteristic of initial access and staging activities performed by ransomware operators or Initial Access Brokers (IABs). The rule excludes known IT-managed deployment paths and signed binaries used by the organization.
Page 31 of 86