Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects potential misuse of an Azure Managed Identity token on a Linux host, where 'curl' is used to interact with the Azure Key Vault API (vault.azure.net/secrets) while presenting an Authorization bearer token. This pattern can indicate an adversary who has obtained a Managed Identity token (e.g., via the Instance Metadata Service) and is attempting to exfiltrate or access sensitive secrets stored in Azure Key Vault.
This rule detects potential ransomware activity by monitoring for high-frequency file rename events (more than 50 in a single dataset aggregation) or file renames resulting in the specific extension '.God8Damn'. Such patterns are highly characteristic of ransomware encrypting local or network files.
Detects a process creating files named 'README.TXT' or 'README.txt' across three or more distinct directories. This behavior is a common indicator of ransomware activity, where an adversary drops ransom notes in multiple folders to maximize visibility after encrypting files.
This rule detects the execution of Java JAR files from suspicious or unconventional directories (such as Temp, AppData, Downloads, or Public folders). It filters out known build tools and CI/CD agents to focus on potentially malicious or unauthorized execution of JAR files that might indicate payload staging or execution in high-risk locations.
This rule monitors DeviceFileEvents to detect the installation of a known malicious browser extension, 'VPN Go: Free VPN'. By matching file activity against the extension's unique ID, this detection helps identify potential browser-based threats, such as information stealer functionality or persistent backdoors installed via malicious extensions.
Detects the use of shell interpreters (sh, bash, zsh) to download content from GitHub using curl (specifically using the -s silent flag) and subsequent base64 decoding of potentially obfuscated payloads using the base64 command with the -D flag.
Detects instances where the 'Werkbit' process initiates either 'curl' or 'bash' to download files from GitHub-related domains. This behavior is indicative of a living-off-the-land technique used to fetch secondary payloads or scripts during a post-exploitation phase.
Detects outbound network traffic containing the specific string 'Secret: ' using raw TCP, often indicative of data exfiltration or unauthorized command-and-control communication via tunneling tools like netcat or ngrok.
This rule detects potentially unauthorized database manipulation of the 'xadmin' platform, including suspicious administrative role modifications and deletions. It also monitors for suspicious Python script execution involving the 'bcrypt' library, which can be used to generate or verify password hashes in potentially malicious scripts.
Detects obfuscated PHP code, specifically webshells, that utilize apostrophe-based concatenation (e.g., 'a'.'b'.'c') to break up strings into 1-3 character chunks. This technique is often used to evade signature-based detection.
Detects the installation or referencing of the malicious @injectivelabs/sdk-ts package version 1.20.21. This specific version was identified as containing a credential-stealing backdoor disguised within telemetry code.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects the execution of MokManager UEFI binaries or administrative activity via the mokutil utility targeting the MokListX denylist. This activity is indicative of Secure Boot configuration changes, such as enrolling unauthorized certificates or bypassing MOK (Machine Owner Key) denylist enforcement, which can facilitate the persistence or execution of malicious boot-level code.
This rule detects processes command lines containing keywords associated with anti-debugging techniques, such as 'PT_DENY_ATTACH' (a common macOS ptrace flag used to prevent debugger attachment) or generic 'ptrace' and 'sysctl' system calls often leveraged by malware for process introspection or debugger evasion.
Detects telemetry consistent with GigaWiper's command 8 'route manager' function, which binds or unbinds targeted routing keys against a RabbitMQ 'Topic' exchange using a mode of operation (1/2/3) to enable non-broadcast, targeted command delivery over AMQP C2 channels.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects telemetry consistent with GigaWiper's command 8 'route manager' function, which binds or unbinds targeted routing keys against a RabbitMQ 'Topic' exchange using a mode of operation (1/2/3) to enable non-broadcast, targeted command delivery over AMQP C2 channels.
Detects potential anonymization attempts by identifying systems that connect to the Tor network check service followed closely by processes accessing local machine identifiers, such as machine-id or board serial numbers. This behavior may indicate an actor attempting to verify anonymity or fingerprint a host while routing traffic through Tor.
Detects the execution of unusual or unauthorized processes spawned during an 'npm install' operation, specifically those occurring within a 'node_modules' folder context. This behavior is indicative of potential supply chain attacks where a malicious package executes unauthorized code during installation.
Detects the installation or network activity associated with the malicious npm packages 'nodemon-sudo' (v3.1.16) and 'tslint-conf' (v7.2.1). These packages use typosquatting or brand impersonation (targeting 'nodemon' and 'pino') by leveraging forged maintainer and author metadata to trick developers into installing them.
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
Page 154 of 341