Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
54
22
10
8
7
Contributors
23
21
16
12
7
Categories
58
36
34
24
16
Platforms
93
18
4
4
1
Products / Services
36
25
12
7
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
2
IDS Protocols
4
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Detects the use of built-in Windows utilities (icacls.exe, cacls.exe, attrib.exe) to modify file permissions (granting or denying access) or file attributes (hidden/system) on sensitive Windows directories or specific suspicious filenames often associated with malicious activity.
This rule detects the creation of suspicious files, specifically .lnk files or files containing 'JUNCTION' in their name, within the 'AppData\Local\Temp' directory. It further refines the detection to look for paths that contain '..\', indicating a recursive or unusual directory structure, which can be used to hide malware or evade detection.
Detects creation of dot-prefixed hidden files used to hide malware on Linux/macOS
Detects the creation of hidden files (starting with a dot) in the `/tmp` directory on Linux systems. This behavior can be indicative of malware like Miasma hiding intermediate exfiltration data or configuration files.
This rule detects the creation of hidden files or directories (those prefixed with a dot) over an SSH connection. Specifically, it looks for the 'mkdir .' string within TCP traffic on port 22, indicating an attempt to create a hidden directory. This technique is often used by attackers for defense evasion to conceal malicious files or activities.
This rule detects the creation, modification, or renaming of files associated with PCPJack/TeamPCP malware on Linux systems. It specifically looks for these activities in common temporary directories (`/tmp/`, `/dev/shm/`, `/var/tmp/`) and for files with names matching known PCPJack/TeamPCP artifacts (e.g., `pcpcat`, `teampcp`, `xmrig`, `proxy.sh`, `kube.py`, `.pcpx`, `.pcp`) or hidden files (starting with a dot). This activity often indicates the initial staging or persistence mechanisms of the malware.
Explorer File Visibility Downgrade
Cortex XDR
Detects modifications to Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) to conceal files. This technique is often used by malware, such as GammaWorm, as a defense evasion mechanism to hide malicious artifacts from users and security tools. The rule specifically looks for changes to the 'Advanced' registry key path within 'Software\Microsoft\Windows\CurrentVersion\Explorer' that would result in files or file extensions being hidden.
Detects creation of hidden files and directories via remote SSH for artifact hiding
This rule detects attempts to set the hidden attribute on a file using the 'attrib +h' command over a network connection to a Windows machine (port 445). This technique is often used by attackers to hide malicious files from users and system administrators, contributing to defense evasion.
Detects the Vampire Bot malware establishing persistence by copying itself to a suspicious directory and using 'attrib.exe' to set system and hidden file attributes.
Detects the execution of hidden payloads within temporary or shared memory directories (/tmp, /var/tmp, /dev/shm). This behavior is commonly associated with the C0XMO Gafgyt botnet variant, which copies itself to these hidden '.sys' files to maintain persistence and evade detection.
Detects the creation or modification of YTSysConfig.ini or YTSysConfig.ytf, which are runtime configuration files for the ClientSetup/Yangtu payload used in the TAX#TRIDENT campaign. This activity indicates potential deployment or configuration of the malware.
Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs
Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files
Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character
Detects calls to hidden files or files located in hidden directories in NIX systems.
Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging
Detects usage of attrib.exe to hide files from users.
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
Detects Python processes executing the 'attrib +h' command. This behavior was observed in the malicious telnyx PyPI package, which uses it to hide its execution lock file on Windows systems and avoid detection.
Page 3 of 6