Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
63
27
11
4
4
Contributors
17
17
13
12
6
Categories
40
25
25
22
17
Platforms
95
39
22
1
1
Products / Services
21
16
14
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
1
1
1
IDS Classtypes
4
IDS Protocols
3
1
This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
Detects the BQTLock malware's User Account Control (UAC) bypass technique. This technique involves modifying the registry key HKCU\Software\Classes\mscfile\shell\open\command to hijack the EventViewer COM object. Subsequently, eventvwr.exe is launched, which auto-elevates and executes BQT.exe, bypassing UAC.
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.
Detects modification of shell profile files for command execution on login
Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.
Detects enumeration or modification of the AppModelUnlock registry key, specifically 'AllowDevelopmentWithoutDevLicense' or 'IsDeveloperModeEnabled', which are prerequisites for enabling Developer Mode. This activity is relevant to the UNCanny coercion primitive, which leverages loose-file UNC AppX package registration.
Detects modifications to the Windows Image File Execution Options (IFEO) registry key where a debugger value is configured to point to scripting engines like VBScript or Windows Script Host (wscript/cscript). This technique is commonly used for persistence or to intercept process execution by forcing the execution of scripts when legitimate applications are launched.
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Detects instances where the Amazon Q Developer extension spawns suspicious child processes, such as bash or npx, which may indicate the execution of arbitrary commands defined in a potentially malicious .amazonq/mcp.json workspace configuration file.
Matches the hardcoded VAPID Public Key string used by the extension to bypass browser sandboxes and wake the service worker, indicative of the SNOWBELT malware's command and control mechanism.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Detects shell/script execution from .git/hooks/ paths, especially when spawning network-connected or unusual child processes. This activity is indicative of Lazarus Group exploiting Git Hooks for persistence and credential theft within developer environments.
Detects the creation or alteration of a SQL trigger that utilizes sp_invoke_external_rest_endpoint. Attackers can abuse database triggers to automatically exfiltrate newly added credentials or sensitive records in real-time.
Page 2 of 6