Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects various stages of the Charon ransomware deployment and activity, including the writing of ransomware-related files to disk, malicious DLL side-loading, the deployment trigger, and the creation of ransom notes or service associated with Charon.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule detects the creation or modification of scheduled tasks using specific names identified in the Bitdefender APT36 Vibeware report. The rule looks for `schtasks.exe` executions where the command line contains one of the following task names: "MicrosoftEdgesUpdatesTasksMachineUAs-Task", "MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy", "DateAndTimeService", "personalServiceTask", or "LuminousBackupService". This helps identify campaign-specific persistence mechanisms used by APT36 Vibeware.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
Detects the creation or modification of a Claude Code settings file (`.claude/settings.json`). This file can be configured to automatically approve Model Context Protocol (MCP) servers by setting `enableAllProjectMcpServers` to `true` or by using `enabledMcpjsonServers`. This bypasses security prompts designed to warn users about potential command execution, which can lead to Remote Code Execution (RCE) as described in CVE-2025-59536.
Detects the creation of an unusual lock file at `/usr/share/nano/.lock`. This specific path is used by a backdoored Go module (impersonating golang.org/x/crypto) to temporarily store harvested plaintext passwords before exfiltration. The rule specifically looks for file creation events at this highly specific path.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
Detects the modification of the 'check_integrity.sh' script to replace 'exit 1' with 'exit 0'. This is a specific defense evasion technique used by the RESURGE malware on Ivanti Connect Secure devices to ensure the compromised system always appears healthy during integrity scans.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
This rule detects various stages of an attack chain, starting from an Apache ActiveMQ exploit (CVE-2023-46604) leading to LockBit-style ransomware. It identifies process creation anomalies (java.exe spawning certutil.exe for downloads), network connections to known Metasploit C2 infrastructure, the presence of specific ransomware file hashes, and attempts to clear Windows event logs, all indicative of the described attack scenario.
This rule detects modifications to AI assistant configuration files by suspicious processes like package managers (npm, yarn) or shell interpreters (bash, powershell). This activity is indicative of a supply chain attack, specifically the SANDWORM_MODE campaign, where an attacker injects a rogue Model Context Protocol (MCP) server entry to hijack AI tools. This enables automated source code and secret theft via prompt injection.
This rule detects various stages of the CastleLoader malware activity, including C2 communication, process hollowing using AutoIt and jsc.exe, and known malware hashes. It correlates network traffic to a specific C2 server, identifies suspicious process creation patterns where AutoIt launches jsc.exe, and sweeps for known SHA256 hashes associated with CastleLoader.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.
This rule detects activity associated with the RenEngine campaign, which utilizes HijackLoader to deliver Lumma Stealer and ACR Stealer. It identifies malicious activity through three main methods: 1) Endpoint detection of known MD5 hashes associated with the malware, 2) Network traffic (proxy/DNS/netflow) to distribution sites used by the campaign, and 3) Network traffic (proxy/DNS/netflow) to known Lumma Stealer C2 domains.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
This rule detects a multi-stage attack chain associated with BQTLock and GREENBLOOD ransomware. It identifies the staging of registry keys for a fodhelper UAC bypass, the subsequent execution of fodhelper.exe, the creation of run-key persistence, and the execution of processes containing the keyword 'greenblood' in their command line, indicating the final payload or related activity.
This detection identifies network connections from non-browser processes to known Large Language Model (LLM) API endpoints. While some connections may be legitimate developer or application traffic, unexpected processes connecting to these services could indicate unauthorized data exfiltration, corporate espionage, or misuse of AI services.
Detects unsigned processes creating directories and dropping multiple suspicious files (DLLs, executables, crypto libraries) in AppData Temp folders which may indicate malware staging behavior
CrowdStrike Query – Potential Notepad Abuse via WindowsApps
Detects execution of notepad.exe from the Windows Apps directory (excluding version 11.2510) with command-line arguments containing “.md”. This behavior may indicate invocation of a non-standard Notepad build for Markdown file handling, potentially linked to application misconfiguration or malicious activity.
Detects execution of notepad.exe from the Windows Apps directory (excluding version 11.2510) with command-line arguments containing “.md”. This behavior may indicate invocation of a non-standard Notepad build for Markdown file handling, potentially linked to application misconfiguration or malicious activity.
Page 66 of 100