Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects the use of AppArmor administrative and diagnostic tools (aa-exec, aa-status, apparmor_parser) with non-root accounts, or usage containing flags indicative of profile bypass attempts or privilege restriction probing.
This rule detects unauthorized file creation, deletion, or execution activity occurring within the 'Program Files\Windows Media Player\' directory by processes other than standard Windows Media Player executables. It flags activity such as creating non-media files (executables, scripts) or using system binaries like cmd, powershell, wmic, or fsutil to perform file operations in this directory. This behavior is indicative of potential masquerading or persistence techniques where an attacker places malicious payloads in a seemingly legitimate system location.
Detects Active Directory dataset extraction techniques used by MexicanMafia (Operation Escaneo), including ntds.dit access, secretsdump execution, VSS shadow copy abuse, and BloodHound-style AD enumeration for long-term persistence and reconnaissance against critical infrastructure.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
Detects anomalous, high-volume npm package publication patterns from a single user account within a 5-minute window. This behavior is indicative of automated worm propagation or supply chain attacks using compromised developer tokens, specifically identified by high-frequency 'publish' events.
Detects the execution of potentially suspicious cleanup and maintenance commands (e.g., clearing history, changing permissions, removing files) on Linux systems that are often associated with post-exploitation activity or evidence removal. The rule monitors for these patterns specifically when initiated by commands involving common suspicious file paths like 'isp.sh', 'lambsys', or '/var/tmp/.xlamb'.
This rule detects attempts to disable, stop, or tamper with security-critical Linux system services and configurations. This includes stopping AppArmor, disabling firewalls (iptables, nftables, ufw), disabling SELinux, and modifying file attributes with 'chattr' to potentially hinder security monitoring or unauthorized file modifications.
This rule detects potentially malicious command-line arguments used with common Linux utilities. It monitors for: the use of 'unshare' for namespace manipulation often used for privilege escalation or container escapes, the 'ip xfrm' command for configuring IPsec policies, and the loading of kernel modules ('modprobe'/'insmod') with suspicious parameters ('esp4', 'esp6', 'rxrpc') which could indicate the installation of malicious rootkits or kernel-level backdoors.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.
Detects the execution of PowerShell commands that query system hardware and environment configurations often used by malware for sandbox detection, virtualization identification, or anti-analysis checks. The rule looks for queries related to VM guest tools (VMware, VirtualBox), BIOS/BaseBoard information, CPU core counts, total memory, and environment variables related to sandbox artifacts.
Detects the Drun/Chromelevator loader (drun.exe) performing cross-process memory allocation and remote thread creation via direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR user-mode API hooking during reflective payload injection. The rule specifically looks for 'drun.exe' initiating these syscalls within a 5-minute window.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the 'lambsys' malware terminating competing cryptocurrency miner processes (such as xmrig, kinsing, or watchdog) using process termination commands (pkill, kill, killall) from a non-root shell. The detection further correlates this activity with the launch of a new miner binary from temporary directories and subsequent outbound network connections to common mining pool ports.
Detects the creation of hidden, dot-prefixed staging directories in /tmp/ or /var/tmp/ commonly associated with the 'lambsys' cryptominer dropper. The rule monitors for the creation of a hidden directory, multiple subsequent file drops (binaries or scripts), execution of chmod +x on these files, and final execution of the binary. A lower-severity alert is triggered when a non-interactive web server process creates such a directory.
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.
Detects the multi-stage execution chain associated with the Gamaredon group's PteroEffigy loader. The rule monitors for PowerShell or scriptrunner instances originating from suspicious directories (AppData/Temp) that employ .NET reflection to load DLLs into memory. It then detects the subsequent creation of a scheduled task with a random alphanumeric name and the eventual execution of regsvr32 or rundll32 by that task to load the malicious DLL. Additionally, the rule identifies potential command-and-control activity by detecting specific Kazuar malware HTTP User-Agent strings.
Page 344 of 864