Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects instances where a Perl interpreter attempts to mask itself as a Samba (smbd) service process, or where smbd/perl processes initiate network connections on port 5000, and identifies smbd processes spawned by non-standard parent processes like sh, bash, or perl, which is indicative of potential unauthorized service manipulation or backdoor activity.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects the execution of GSocket (gs-netcat), a network tool often used for establishing persistent backdoors, interactive shells, or SOCKS proxies. The rule identifies execution with common flags for daemonization, interactive shell access, or SOCKS proxying, as well as instances where the process masquerades as common system binaries (e.g., smbd, sshd) or is initiated from system persistence directories like systemd or init.d.
Detects instances where the sshd process or PAM-related processes create or write to files within temporary directories (/tmp/ or /var/). This behavior is often associated with the staging of malicious scripts, backdoors, or tools during an attack involving credential abuse or unauthorized access via SSH.
Detects instances where the DllHost.exe process creates or writes files with common executable or script extensions (.exe, .dll, .ps1, .bat, .cmd, .vbs, .hta, .scr, .sh) into suspicious, publicly writable, or temporary directories. This behavior is indicative of potential malicious payload staging, masquerading, or post-exploitation activity.
This rule detects two suspicious behaviors associated with OpenSSH components: the direct modification or replacement of critical OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp), or the use of these processes to write files to suspicious or non-standard locations (such as /tmp/ or unauthorized subdirectories within /var/log/), which may indicate credential harvesting or the presence of a backdoor.
This rule detects potential malicious activity characterized by a high volume of file write operations (at least 20 within a 30-minute window) followed by an attempt to delete those files or the files themselves. The rule monitors Sysmon events, specifically looking for processes that exhibit significant write behavior and then initiate a deletion command via cmd.exe, PowerShell, or the native Windows MoveFileEx self-deletion mechanism.
Detects the initialization and execution of processes within the Windows Subsystem for Linux (WSL) environment, specifically tracking the start of WSL processes or the invocation of WSL-related binaries like wsl.exe and vmmem. This allows security teams to monitor interop operations between the host Windows OS and the Linux subsystem.
Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.
Detects the execution of Red Lamassu's JFMBackdoor payload by monitoring for fltMC.exe being launched from temporary directories. The rule identifies a sideloading technique where fltMC.exe loads a malicious FLTLIB.dll, which then injects the flt.bin shellcode stub into memory, avoiding writing the malicious PE file to disk.
Detects the co-occurrence of JFMBackdoor DLL sideloading via fltMC.exe and an additional PlugX DLL sideloading event originating from a temporary directory on the same host. This pattern is indicative of the Red Lamassu actor group deploying shared tooling for lateral movement and persistence.
Detects the execution of JScript Encoded (.jse) files via wscript.exe or cscript.exe when spawned by Office applications or email clients. This pattern is indicative of Kimsuky initial stage payloads, where a malicious lure file is dropped into a user-writable directory (e.g., Temp, AppData, Downloads) and subsequently executed.
Detects malicious PowerShell command lines exhibiting multi-stage base64 decoding patterns characteristic of the Kimsuky NUKESPED JSE loader. The rule identifies suspicious chaining of base64 decoding (FromBase64String) with execution primitives (Invoke-Expression, IEX), unicode encoding specifications, or EncodedCommand arguments used to bypass security controls and deobfuscate stage-two payloads.
Detects the execution of short (6-10 characters), randomized alphanumeric executables located in typically writeable directories like ProgramData or Temp. The detection triggers when these files are spawned by common scripting engines (wscript.exe, cscript.exe, or powershell.exe), which is a characteristic behavioral pattern for the Kimsuky NUKESPED malware's secondary stage where a JSE dropper executes a renamed payload.
Detects the JDY botnet's infection chain on Linux systems, characterized by script-based processor architecture reconnaissance followed by the retrieval, execution, and subsequent deletion of architecture-specific (MIPS) binaries. This rule monitors shell-based command sequences involving system information gathering, network-based file downloads, and immediate removal of the downloaded file.
Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.
Detects suspicious activity related to the OpenSSH server suite, including unauthorized modifications to core SSH binaries by non-package-manager processes, sshd processes writing files to temporary directories (a common indicator of credential harvesting), and sshd execution from non-standard file paths which may indicate a trojanized binary or persistence mechanism.
Detects suspicious file drops by DllHost.exe into staging directories (e.g., C:\Users\Public\ or C:\ProgramData\) occurring shortly after the execution of wsl.exe, where the DllHost process itself exhibits no network activity in the host telemetry. This behavior is indicative of an attacker leveraging the Windows Subsystem for Linux (WSL2) to download payloads or tools that bypass standard Windows network monitoring, leaving behind an artifact dropped by a COM surrogate.
Detects instances where wscript.exe or cscript.exe spawn PowerShell with suspicious command-line arguments indicative of the Kimsuky NUKESPED campaign. This involves PowerShell commands using window-hidden styles, decoding flags, or referencing ProgramData/path-traversal patterns often used by Kimsuky to load malicious payloads.
Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.
This rule detects activities associated with the Kimsuky NUKESPED malware loader, including the execution of malicious .jse scripts, PowerShell-based obfuscated payload decoding using 'ProgramData' as a staging path, and the subsequent execution of the 'zlrenu8.exe' payload. The rule specifically targets the multi-stage infection chain where scripts are used to perform anti-analysis and sandbox evasion before launching the primary malicious component.
Page 359 of 864