Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects attempts to create hidden files or directories in the /tmp directory on a remote host via SSH. Specifically, it looks for SSH traffic (tcp port 22) containing the strings "touch ." and "/tmp/." (case-insensitive). This behavior is often associated with adversaries attempting to hide their artifacts on a compromised system.
Detects the creation or modification of TieringEngineService.exe in the System32 directory, which is indicative of potential Local Privilege Escalation (LPE) via junction redirection, as observed in the RedSun exploit (CVE-2026-41091). The rule specifically excludes activities originating from the Windows WinSxS directory to reduce false positives from legitimate system updates.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
Detects the creation of files ending with '.sig', '.asc', or '.cer'. These extensions are commonly associated with digital signatures, PGP/GPG keys, and certificates, which could indicate activities like code signing, certificate generation/import, or PGP/GPG key manipulation by an adversary.
This rule detects an unusually high number of file creations (50 or more within an hour) in folders whose paths contain 'source' or 'src'. This activity is grouped by the initiating process and could indicate various activities such as software compilation, deployment, or potentially malicious actions involving rapid file generation in development-related directories.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects an unusually high number of file creations (50 or more within an hour) in folders whose paths contain 'source' or 'src'. This activity is grouped by the initiating process and could indicate various activities such as software compilation, deployment, or potentially malicious actions involving rapid file generation in development-related directories.
This rule detects when a single process account creates 5 or more files containing 'database', 'db', or '.sql' in their filenames within a one-hour window. This could indicate an attempt to stage, exfiltrate, or manipulate database files.
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
This rule detects suspicious activity indicative of post-quantum ransomware, combining two main indicators: the execution of processes with command-line arguments related to post-quantum cryptographic algorithms (Kyber, ML-KEM, NTRU, Dilithium, Falcon, SPHINCS) and the creation of common ransomware notes (README.txt, DECRYPT.txt, RESTORE.txt, PAYMENT.txt, RANSOM.txt). The cryptographic operation detection specifically looks for high or system integrity processes and excludes common legitimate cryptographic tools. The rule correlates multiple cryptographic operations within a short timeframe and the creation of ransom notes to identify potential ransomware deployment.
Detects the creation or modification of specific LaunchAgent plist files used by the arm64 and x86_64 variants of SStar Agent malware on macOS for persistence. The rule looks for file events (creation, modification, rename) within the /Library/LaunchAgents/ directory, specifically targeting 'com.wpnuersvc.agent.plist' and 'com.googleupdate.sstaragent.plist' filenames.
Detects the creation of CRYPTBASE.dll outside of the standard Windows system directories. This indicates an attacker staging the DLL for sideloading to exploit CWE-427 upon application execution.
This rule detects the creation or modification of the '.vscode/extensions.json' file. This file is critical for managing extensions within Visual Studio Code environments. Attackers can exploit modifications to this file, as demonstrated in recent zero-day attacks, to introduce malicious extensions, potentially leading to code execution or other forms of compromise within a developer's environment. The detection focuses on file system events (creation and modification) targeting this specific configuration file.
Detects the staging of the Lucid Stealer hidden self-copy loader and the SQLite CLI helper binary in the Temp directory. This rule specifically looks for file creation events in the user's Temp directory with filenames matching patterns associated with Lucid Stealer's staging activities: 'winupd_*.exe' for its self-copy loader and '_sq3e_*.exe' for its SQLite helper.
This rule detects attempts to drop a systemd timer unit file via a web shell. It specifically looks for HTTP POST requests (flow:to_server) containing both '.timer' and '[Timer]' in the client body, indicating the creation or modification of a systemd timer unit.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the creation of a file on a server system by common network utilities (curl, ftp, powershell, winscp, certutil) within a 5-minute window of a network connection to common ports (21, 22, 80, 443). This could indicate ingress tool transfer or data exfiltration attempts.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
Page 174 of 217