Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the GitHub Actions runner executing the Bun runtime to run a hidden index.js payload, specifically associated with the compromised 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' actions. The rule filters for process execution context tied to GitHub runner internals and validates that the Bun execution follows the pattern observed in these supply chain attacks.
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects the compiled x86/x64 fetch-decode-execute dispatch loop used by the Vidar Stealer custom VM bytecode interpreter (v2.0+). The rule identifies the structural jump-table bounds-check and computed-jump idiom that is consistent across different builds of the malware, despite randomization of opcode values and XOR keys.
Detects the execution of LNK files masquerading as PDF files through the use of double extensions (e.g., .pdf.lnk). The rule monitors for processes spawned by explorer.exe that contain '.pdf.lnk' in the command line and trigger child processes like PowerShell, CMD, WScript, or MSHTA, which are common indicators of malicious intent.
Detects trojanized versions of Zoom installers that bundle legitimate application installers alongside malicious components including a VBScript persistence mechanism (OneDriveUpdateScheduler) and the VelvetCake PowerShell downloader/C2 framework.
Detects network traffic indicative of VelvetCake malware exfiltrating data. The rule specifically monitors for HTTP POST requests to 'logout.php' containing 'OKey' and 'Who' parameters, using a user agent string that includes 'WebClient', which is often associated with PowerShell-based network requests.
This rule detects suspicious PowerShell activity associated with the Lightlife RAT, specifically targeting Google Chrome's login data files to steal credentials and performing checks for the presence of cryptocurrency wallets.
Detects modifications to Group Policy Objects (GPOs) or GPO links in Active Directory, specifically targeting known malicious GPO identifiers, GPO payloads, or changes to policy versioning and linking that indicate unauthorized configuration changes for persistence or privilege escalation.
Detects multiple endpoints setting their desktop wallpaper to a common file located on a remote UNC path or containing 'sysvol'. This behavior is often indicative of GPO-based configuration for persistence or malware staging, where a malicious 'payload.jpg' is used as a cover or to deliver code via vulnerabilities in image parsing libraries.
Detects instances where the Claude Desktop application spawns a terminal or shell process that immediately executes commands associated with downloading remote payloads or accessing sensitive cryptocurrency wallet artifacts. This behavior is indicative of potential AI prompt injection where an AI assistant is coerced into executing malicious commands without user authorization.
Detects the copying of the legitimate Windows curl.exe binary to a renamed filename within user-writable directories (e.g., %TEMP%) via PowerShell. This technique is often used to masquerade the utility for stealthy file downloads. The rule also identifies the execution of these renamed binaries by checking for a mismatch between the current filename and the binary's original file description embedded in its PE header.
This rule monitors for indicators of compromise (IOCs) associated with the Lunex Malware-as-a-Service (MaaS) campaign. It aggregates telemetry from file creation, process execution, and network connections to identify the presence of known malicious hashes, C2 IP addresses, phishing-related domains, and specific payload URLs.
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
Detects non-browser processes (e.g., non-chrome.exe/msedge.exe) modifying critical browser configuration files such as 'Secure Preferences' followed by near-simultaneous writes to extension-related directories like 'Extension State' or 'Extensions'. This pattern is indicative of a malicious attempt to bypass browser security integrity checks to silently install or load unauthorized extensions.
Detects non-browser processes (e.g., non-chrome.exe/msedge.exe) modifying critical browser configuration files such as 'Secure Preferences' followed by near-simultaneous writes to extension-related directories like 'Extension State' or 'Extensions'. This pattern is indicative of a malicious attempt to bypass browser security integrity checks to silently install or load unauthorized extensions.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
This rule detects a credential theft pattern where a browser process is forcefully terminated using taskkill, followed shortly by the creation of a 'wd_tmp.db' file in browser user data directories. This behavior is indicative of malware attempting to stage and exfiltrate browser credentials like cookies and login data.
Page 139 of 1908