Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
113 detections
Filters
Last updated
All Time
Detection languages
47
22
12
8
8
Contributors
36
28
14
11
5
Categories
63
25
22
18
14
Platforms
49
38
31
17
7
Products / Services
15
14
13
13
10
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
12
12
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects signs of a supply chain attack, specifically referencing the IronWorm/Shai-Hulud pattern, involving the backdating of git commits, manipulation of git environment variables (GIT_COMMITTER_DATE/GIT_AUTHOR_DATE) to mask malicious activity history, and the use of 'touch' commands to modify file timestamps on project-related binaries and configuration files.
Detects activity associated with the RoguePlanet exploit, which involves creating EICAR content and NTFS Alternate Data Streams (ADS) within specific staging directories (wdtest_temp or RP_<UUID>). This behavior is intended to trigger Windows Defender scans and induce a TOCTOU race condition (CVE-2026-50656) by manipulating file operations near the wermgr.exe process.
This rule detects potentially suspicious modifications to Nginx configuration files or the usage of FastCGI directives such as fcgiwrap, fastcgi_pass, and proxy_pass. It specifically monitors for actions related to configuration changes (write, modify, create) or the establishment of backend communication via FastCGI parameters, which may indicate an attempt to gain remote code execution or persistence on a web server.
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
Detects high-volume database record modifications
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects unauthorized or anomalous modifications to local vector database files (e.g., ChromaDB, FAISS SQLite) by non-standard processes, indicating an attacker attempting to poison the AI's retrieval context directly. The rule specifically looks for file modifications or renames of common vector database files (chroma.sqlite3, faiss_index.index, index.faiss) where the initiating process is not a standard AI/ML runtime (python.exe, node.exe, docker.exe) and there is an outbound network connection from that process to a non-localhost IP.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
This rule detects attempts to modify the end-of-file marker on a network share, specifically looking for the 'SetEndOfFile' operation over SMB. This activity can be indicative of an attacker manipulating file sizes or content on shared resources, potentially as part of data staging or to evade detection. The rule is configured with a threshold to alert on 20 such events from the same source within 30 seconds, aiming to reduce noise from legitimate, infrequent operations.
Detects high-volume SQL operations indicative of data manipulation attacks
This rule detects attempts to manipulate stored records within an MSSQL database. It specifically looks for TCP traffic directed to port 1433 (the default MSSQL port) containing the keywords "UPDATE" and "SET" (case-insensitive) in the flow to the server. A threshold of 50 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating potential bulk data modification.
This rule detects attempts to modify stored data within a MySQL database, specifically looking for 'UPDATE' and 'WHERE' clauses in TCP traffic directed to the MySQL default port (3306). It triggers an alert if 50 such events are observed from the same source IP within a 30-second window, indicating potential malicious activity aimed at data integrity compromise.
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.
Detects modification of critical ICONICS Suite configuration files by unauthorized processes. Attackers can modify these files, such as changing the SMSLogFile path in IcoSetup64.ini, to redirect privileged file writes for privilege escalation or DoS, as seen in the CVE-2025-0921 exploit chain.
Detect a system being shutdown or put into different boot mode
Detects unexpected file modifications by 'dns.exe', which could indicate remote code execution or other exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out modifications to 'dns.log' to reduce false positives.
Detects when a virtual disk (.vmdk) from one virtual machine is attached to a different virtual machine. This is a key TTP used by threat groups like UNC3944 to perform offline credential theft (e.g., copying NTDS.dit from a domain controller) by mounting the disk to a separate, attacker-controlled staging VM.
Page 5 of 6