Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
15
5
3
3
1
Contributors
5
5
4
4
3
Categories
15
6
4
4
3
Platforms
14
8
4
1
Products / Services
3
3
2
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects the creation of a Git branch where the branch name matches the pattern of a 40-character hexadecimal SHA-1 hash. This behavior is associated with the 'Plugin4Shell' technique, which exploits how some git implementations prioritize matching ref names over target commit objects, enabling an attacker to manipulate or swap code in automated systems or AI coding agents that rely on SHA-pinning.
Detects the creation of a Git branch where the branch name matches the pattern of a 40-character hexadecimal SHA-1 hash. This behavior is associated with the 'Plugin4Shell' technique, which exploits how some git implementations prioritize matching ref names over target commit objects, enabling an attacker to manipulate or swap code in automated systems or AI coding agents that rely on SHA-pinning.
Detection for reported campaign delivering a trojanized, non-digitally signed TrueConf client installer to users connecting to a compromised TrueConf server.
This rule detects potential attempts to bypass macOS Gatekeeper security checks by identifying the removal of the 'com.apple.quarantine' extended attribute using the 'xattr' utility, or by changing file permissions using 'chmod' on files marked with the 'com.apple.verified' attribute. Adversaries use these techniques to ensure malicious or untrusted binaries execute without user prompts or security warnings.
Detects 7-Zip (7z.exe / 7zG.exe) writing executable files to user-accessible directories, potentially leveraging CVE-2026-46331. This vulnerability allows an adversary to manipulate the Zone.Identifier Alternate Data Stream (ADS) of extracted files by embedding a crafted RAR5 stream, effectively setting the ZoneId to 0 (My Computer) and bypassing Windows SmartScreen warnings upon subsequent execution.
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
This rule detects the delivery of a payload designed to bypass trust controls via HTTP. It specifically looks for HTTP responses (flow:to_client) containing the 'MZ' magic bytes (indicating an executable file) within the first 2 bytes of the file data, combined with URI paths that include keywords like 'bypass', 'unsigned', or 'notrust'. This combination suggests an attempt to deliver malicious or untrusted executables that aim to circumvent security mechanisms.
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Detects copying or writing certificate material and modifications to system keychains. Execution of `security add-trusted-cert`.
Detects the execution of a renamed BOINC binary.
Detects when the macOS Script Editor utility spawns an unusual child process.
Detects the 'codesign' utility being used to extract code-signing requirements from trusted macOS system binaries. This is a key step used by malware to forge TCC permissions and inherit the privileges of trusted applications. The rule specifically looks for 'codesign' execution with '-d' and '--requirements' flags targeting common trusted binaries, initiated by scripting interpreters.
Detects execution or presence of a maliciously replaced eScan component reload.exe distributed via a compromised update server. The malicious binary uses an invalid fake digital signature and replaces the legitimate eScan executable.
This rule detects a suspicious `explorer.exe` subprocess spawned by `RazerInstaller.exe` with elevated privileges (System integrity level). While `explorer.exe` can be legitimately invoked by the installer to select a different installation folder, this specific behavior with System integrity can indicate an attempt to exploit a vulnerability in the RazerInstaller software for privilege escalation to LOCAL SYSTEM.
Detects scenarios where an attacker attempts to register a SIP or trust provider in order to mislead signature validation checks.
Detecting LOLDrivers using www.loldrivers.io and MDE telemetry.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM
Detects the use of software that is related to the University of California, Berkeley via metadata information.
This indicates it may be related to BOINC software and can be used maliciously if unauthorized.
This indicates it may be related to BOINC software and can be used maliciously if unauthorized.
Page 1 of 2