Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,542 detections
Filters
Last updated
All Time
Detection languages
2,477
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,453
11,837
5,876
5,154
4,865
4,542
Platforms
3,840
1,049
473
39
29
Products / Services
1,834
1,138
211
183
171
MITRE Techniques
1,604
1,422
1,300
748
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of .vbs or .vbe files in the Windows Startup folder. This technique is actively used by Gamaredon (leveraging CVE-2025-8088) to drop the GammaDrop payload for persistence.
This rule detects the creation of a process named 'conhost.exe' with 'System' integrity level, where the initiating process is an executable file with low global prevalence. This behavior can be indicative of malicious activity, as adversaries might use conhost.exe to execute commands or maintain persistence, especially when launched by an uncommon or suspicious executable.
Detects the creation of 'configA.json' by a Python process, which indicates successful host profiling by KongTuke's ModeloRAT reconnaissance module. This file is typically dropped after the reconnaissance phase to store collected system information.
Detects file creation, modification, or renaming events in the suspicious '%AppData%\WinDataScope' directory. This directory is hardcoded in the FrostyNeighbor dropper for staging PicassoLoader, indicating potential malware activity.
Detects the creation of an unexpected LaunchAgent property list named 'com.google.keystone.agent.plist' paired with the creation or execution of a binary at '~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate'. This exact path and plist combination is used by the SHub Reaper malware to establish persistent backdoor access while masquerading as a Google software update.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Detects the registration of the PLURIBUS Cloud Files sync provider used by the CVE-2023-36036 (cldflt.sys heap overflow) privilege escalation exploit in the Rapid7-documented ModeloRAT incident. The exploit registers a fake sync provider with the specific GUID {904EE598-0511-4664-82A8-22C4A7501044} pointing to %TEMP%\cldflt\, then writes a placeholder file (Link.log) to trigger the vulnerable code path. The provider GUID, name, and registry path are all unique to this exploit variant — legitimate sync providers (OneDrive, Dropbox, Box) use vendor-specific GUIDs and never register under %TEMP%.
Detects the creation of an NT Object Manager symbolic link pointing to CTF.AsmListCache.FMPWinlogon paths, indicative of GreenPlasma Stage 1. This activity is captured via Windows Security Event 4663 (Object Access) and specifically filters for 'SymbolicLinkObject' creation where the object name contains 'CTF.AsmListCache.FMPWinlogon'.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation or presence of specific artifact files (.ghostlock_authorized and ghostlock_cache.json) associated with the GhostLock proof-of-concept availability weapon. These files are used by the tool to manually authorize locking operations in specific directories and to cache discovered file lists for rapid session re-establishment.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
This rule detects a potential privilege escalation attempt on Linux systems. It looks for two main indicators: first, the execution of the 'su' command from a user's home directory by a process whose executable was recently created in a user's home directory and identified as an ELF binary. Second, it identifies systems where public-facing network connections were made by processes using common remote file transfer utilities (curl, wget, lftp, axel, aria2, scp, rsync, ftp) to fetch code, followed by the execution of a process with 'algif-aead' in its command line, which could indicate fileless execution after remote code fetching. The combination suggests an attacker might be fetching malicious code, potentially compiling it, and then using it to escalate privileges via 'su' or executing it filelessly.
Detects the creation of files indicative of the compromised Checkmarx AST plugin version 2026.5.09 being deployed. This rule identifies specific malicious filenames or known compromised SHA256 hashes associated with the TeamPCP backdoor.
https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the creation of the specific LaunchAgent plist file (com.vfrfeufhtjpwgray.plist) used by the macOS execution chain for persistence in the REF6598 campaign delivering PHANTOMPULSE RAT.
Page 178 of 217