Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,680 detections
Filters
Last updated
All Time
Detection languages
10,196
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,285
2,978
2,238
1,835
1,458
Platforms
10,391
1,109
809
155
98
Products / Services
10,680
9,759
6,693
4,421
3,750
MITRE Techniques
3,819
3,134
1,801
1,572
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects access to platforms selling zero-day vulnerability intelligence
Detects XOR-encrypted payload delivery used to evade signature detection
Detects stripped executable payloads with debug information removed for evasion
Detects IP geolocation lookups used to determine system geographic location
Detects access to credential files through web shell commands
Detects POST requests to pages matching credential harvesting patterns
Detects credential stuffing attacks targeting account takeover for infrastructure abuse
Detects automated social media account registration used for fake identity infrastructure
This rule detects the creation of a specific mutex pattern associated with the Grixba ransomware. The mutex name starts with 'CPFATE_' and contains the .NET framework version string 'v4.0.30319', which is a unique artifact used by Grixba to ensure only one instance of itself is running.
Detects attempts by the Grixba ransomware to query a specific custom locale registry key (en-US) for geofencing purposes. This activity is indicative of the ransomware checking the system's locale settings, potentially to avoid encrypting systems in certain geographical regions.
Detects the creation or modification of TieringEngineService.exe in the System32 directory, which is indicative of potential Local Privilege Escalation (LPE) via junction redirection, as observed in the RedSun exploit (CVE-2026-41091). The rule specifically excludes activities originating from the Windows WinSxS directory to reduce false positives from legitimate system updates.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
Detects the creation of files ending with '.sig', '.asc', or '.cer'. These extensions are commonly associated with digital signatures, PGP/GPG keys, and certificates, which could indicate activities like code signing, certificate generation/import, or PGP/GPG key manipulation by an adversary.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
This rule detects an unusually high number of file creations (50 or more within an hour) in folders whose paths contain 'source' or 'src'. This activity is grouped by the initiating process and could indicate various activities such as software compilation, deployment, or potentially malicious actions involving rapid file generation in development-related directories.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects processes making a high volume of network connections (10 or more within an hour) to URLs containing 'release' or 'download'. This behavior can be indicative of malware downloading additional components, updates, or exfiltrating data, but could also be legitimate software updates or large file transfers.
This rule detects an unusually high number of file creations (50 or more within an hour) in folders whose paths contain 'source' or 'src'. This activity is grouped by the initiating process and could indicate various activities such as software compilation, deployment, or potentially malicious actions involving rapid file generation in development-related directories.
This rule detects when a single process account creates 5 or more files containing 'database', 'db', or '.sql' in their filenames within a one-hour window. This could indicate an attempt to stage, exfiltrate, or manipulate database files.
Page 423 of 509