Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
Detects the creation of a hidden file named '.git-checker' within system temporary directories (e.g., /tmp or \Temp\). This filename is often associated with adversary activity attempting to stage files, maintain persistence, or perform reconnaissance.
The detection rule monitors for access to files commonly used to store sensitive information, including .git-credentials, .netrc, and .gitconfig files configured to store credentials. Accessing these files is a common indicator of credential theft attempts by adversaries looking for plaintext authentication data to pivot to other systems or services.
Detects the creation of a file named 'DCRCVDrv.sys'. This filename is historically associated with malicious kernel-mode drivers used in cyberattacks, such as the DCRDRV exploit or related persistence/evasion mechanisms involving driver installation.
Detects attempts to modify AMSI (Antimalware Scan Interface) provider registry keys or tampering with the amsi.dll file. These actions are indicative of efforts to disable or blind security instrumentation, often as a precursor to or during malicious code execution.
Detects the presence of specific debug log files ('nb_hook_dbg.txt', 'nb_sleep_dbg.txt', etc.) created within 'C:\WINDOWS\Temp\' by the PIVOTPIPE malware family. These artifacts are produced during the initialization of indirect syscall and sleep-mask evasion routines, serving as a proxy indicator for these stealthy execution techniques.
Detects the execution of known PIVOTPIPE beacon binaries by matching against specific file names and SHA256 hashes. These binaries are associated with post-exploitation activities and internal network pivoting.
Detects the execution of known PIVOTPIPE RAT binary files based on their SHA256 hashes or file names. PIVOTPIPE RAT is capable of token manipulation and impersonation techniques (e.g., ImpersonateLoggedOnUser, DuplicateTokenEx) to perform privileged operations or escalate security context.
Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.
Detects suspicious behavior where an identical executable (same path and SHA256) is launched twice within a short window (60 minutes) following a system reboot, utilizing two distinct persistence methods: one triggered via the Task Scheduler (under svchost.exe -k netsvcs) and one via a user logon autostart mechanism (spawned by explorer.exe).
Detects the use of reg.exe to query the MachineGuid value from the Windows Registry (HKLM\SOFTWARE\Microsoft\Cryptography). This behavior is often associated with adversary reconnaissance, specifically host fingerprinting, to uniquely identify compromised machines.
Detects the use of tasklist.exe combined with process filtering (findstr) to identify common debugger names such as 'dbg.exe', 'x64dbg.exe', 'windbg.exe', or 'ollydbg.exe'. This technique is a known evasion tactic employed by the Kimsuky threat group (and others) to check for the presence of analysis tools before continuing execution of malicious batch scripts.
Detects unauthorized access to common browser credential and cookie files by processes other than standard web browsers. This activity is a common indicator of credential harvesting malware or unauthorized data collection.
Detects modifications to Windows Registry Run keys that execute PowerShell scripts named 'Update.ps1' with hidden window and bypass execution policy flags. This pattern is consistent with Lightlife RAT persistence mechanisms.
This rule detects potential AI agent prompt injection by monitoring email subjects or attachment names for keywords often associated with system instruction overrides. It correlates these potentially malicious emails with subsequent execution of common administrative or script-interpreting binaries (e.g., PowerShell, cmd.exe) on the recipient's device within a one-hour window, suggesting a potential successful hijack of an automated process or AI agent.
Detects the creation of common script files (.bat, .ps1, .vbs, .cmd, .js) within the Windows startup directory. This is a common technique used by adversaries or compromised AI agent frameworks to achieve persistence by ensuring arbitrary code executes upon user login.
Detects instances where a Semantic Kernel AI agent, running via Python or .NET, accesses sensitive local files like SSH keys, cloud credentials, or environment files immediately before triggering a potential file upload operation.
Detects instances where an AI agent (e.g., Semantic Kernel) launches command-line tools commonly used to perform bulk data destruction or system wiping, such as file deletion commands, volume shadow copy removal, or disk formatting. This rule flags suspicious orchestration by AI agents that may be acting outside of expected parameters.
Detects attempts to bypass input sanitization in AI agent frameworks, specifically Semantic Kernel, by using Python bracket or subscript notation to access sensitive attributes or functions (e.g., __class__, __subclasses__, __import__, eval, exec). This technique is characteristic of filter injection attacks aiming to achieve remote code execution in AI agent environments.
Detects instances where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command-line utility or scripting engine (e.g., PowerShell, WScript, Cmd) to execute a file located within common download or temporary directories. This behavior is a common indicator of a user executing a malicious file downloaded from the internet.
Page 66 of 465