Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
227 detections
Filters
Last updated
All Time
Detection languages
176
45
4
2
Contributors
93
45
35
20
11
Categories
77
72
31
30
21
Platforms
151
57
28
15
8
Products / Services
10,665
9,758
6,692
4,418
3,749
227
MITRE Techniques
75
72
69
39
38
CVEs
4
4
4
4
4
Detects suspicious execution of the 'tar' utility spawned by 'prl_disp_service' (Parallels Desktop service) using potentially malicious command-line arguments. The rule specifically flags the use of '--use-compress-program' or the inclusion of double quotes in the command line, which are often used to achieve arbitrary code execution via shell injection in this context.
Detects suspicious execution of the 'tar' utility spawned by 'prl_disp_service' (Parallels Desktop service) using potentially malicious command-line arguments. The rule specifically flags the use of '--use-compress-program' or the inclusion of double quotes in the command line, which are often used to achieve arbitrary code execution via shell injection in this context.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects suspicious execution of the 'tar' utility spawned by 'prl_disp_service' (Parallels Desktop service) using potentially malicious command-line arguments. The rule specifically flags the use of '--use-compress-program' or the inclusion of double quotes in the command line, which are often used to achieve arbitrary code execution via shell injection in this context.
Detects suspicious execution of the 'tar' utility spawned by 'prl_disp_service' (Parallels Desktop service) using potentially malicious command-line arguments. The rule specifically flags the use of '--use-compress-program' or the inclusion of double quotes in the command line, which are often used to achieve arbitrary code execution via shell injection in this context.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
This rule detects the presence of known Chaos ransomware samples by matching their SHA256 hashes against process execution events and file events. If a process with a matching hash is executed or a file with a matching hash is observed, an alert will be triggered.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
Detects phishing links delivered through Microsoft Teams or Slack messages
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
This rule detects potential persistence mechanisms related to browser extensions. It looks for processes launching Chrome or Edge with the '--load-extension' command-line argument, which can be used to load unpacked extensions. Additionally, it monitors registry modifications to 'ExtensionInstallForcelist' that contain 'http' or 'crx', indicating a forced installation of an extension, potentially from a remote source or a local file.
Detects attempts to read the memory of browser processes (Chrome, Edge, Firefox, Brave, Opera). This activity can be indicative of credential dumping or other forms of data exfiltration from web browsers.
Page 2 of 11