Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Identifies web server processes dropping PHP files. This is a strong indicator of web shell persistence following a successful PHP object injection or remote code execution attack in WordPress environments.
Detects specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files (e.g., mev.png, USO.ico, USO.png) to evade detection.
This rule detects the creation, modification, or renaming of files associated with PCPJack/TeamPCP malware on Linux systems. It specifically looks for these activities in common temporary directories (`/tmp/`, `/dev/shm/`, `/var/tmp/`) and for files with names matching known PCPJack/TeamPCP artifacts (e.g., `pcpcat`, `teampcp`, `xmrig`, `proxy.sh`, `kube.py`, `.pcpx`, `.pcp`) or hidden files (starting with a dot). This activity often indicates the initial staging or persistence mechanisms of the malware.
Detects installation of potentially malicious VS Code or IDE extensions
Detects VBA stomped Office documents where source code is stripped to evade analysis
Identifies .lnk files dropped into Startup folders, a persistence technique tied to WinRAR exploitation.
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
This rule detects when a Windows logon script (specifically a .bat file) is written to the NETLOGON share over SMB. This activity is often associated with persistence techniques where an attacker modifies or creates a logon script to execute malicious code when a user logs on to a domain-joined machine.
This rule flags a large number of files receiving a '.lalia' extension at once, indicating potential Lalia ransomware activity. Bulk extension changes are a common initial indicator of ransomware infection. The rule looks for at least 20 file events (renamed, created, or modified) where the file name ends with '.lalia' within a 30-day window.
This rule watches for creation of ransom notes associated with the Lalia family. Notes often appear in multiple folders once encryption finishes. Identify patient zero and check offline backups. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects the writing of an 'autorun.inf' file to a Server Message Block (SMB) share, specifically targeting removable media shares. The presence of 'autorun.inf' on removable media is often associated with malware attempting to auto-execute when the media is inserted into a Windows system.
Monitors for network connections originating from the VSCode extension host process to GitHub API endpoints immediately following a new extension installation. This may indicate token exfiltration or repository enumeration from a malicious extension.
Detects the creation of zip archives matching the specific naming convention (Unix-[HOSTNAME]-[ID].zip) used by the UnixStealer malware family. Detecting these host artifacts enables early discovery before successful exfiltration.
Detects the creation of temporary '.tmp' files starting with 'Hid' in the user's temporary directory, which is indicative of the PoisonX dropper deploying its driver. This behavior is associated with the initial stages of PoisonX malware execution.
Detects autorun.inf files written to removable media for self-propagation
Detects modification of LNK shortcut files in startup folders for autostart persistence
Detects Dynamic Data Exchange formula injection in Office documents for code execution
Detects download of tools designed to bypass Windows trust control mechanisms
Detects SVG files embedding base64 executables for HTML smuggling
Detects download of macro-enabled Office templates for persistent macro execution
Page 171 of 217