Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,542 detections
Filters
Last updated
All Time
Detection languages
2,477
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,453
11,837
5,876
5,154
4,865
4,542
Platforms
3,840
1,049
473
39
29
Products / Services
1,834
1,138
211
183
171
MITRE Techniques
1,604
1,422
1,300
748
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of folders or files associated with the malicious ChatGPT-China and ChatMoss VS Code extensions (MaliciousCorgi campaign). These extensions silently exfiltrate developer source code to external servers.
Detects the creation of specific file names associated with EarthWorm and ReverseSocks5 tunneling tools in common temporary directories (/tmp/ and /var/tmp/) on Linux systems. These tools are often used for command and control and data exfiltration.
Detects the creation of specific file names associated with EarthWorm and ReverseSocks5 tunneling tools in common temporary directories (/tmp/ and /var/tmp/) on Linux systems. These tools are often used for command and control and data exfiltration.
Detects the creation of specific file names used by CL-STA-1132 for EarthWorm and ReverseSocks5 tunneling tools in /tmp/ and /var/tmp/ directories on Linux systems. This activity has been observed in CVE-2026-0300 exploitation.
Detects the creation of specific file names used by CL-STA-1132 for EarthWorm and ReverseSocks5 tunneling tools in /tmp/ and /var/tmp/ directories. These file names are highly specific to the CL-STA-1132 campaign.
PhantomRaven Temporary Payload Creation
Cortex XDR
Detects Node.js dropping the PhantomRaven dynamic Stage-3 payload into the /tmp directory. The attack utilizes a file-based temporary dropper that operates outside of standard NPM package paths, bypassing static code analysis.
Detects the creation of Pheno plugin output files (phonelink-<COMPUTERNAME>.txt) in the Microsoft feedback folder. This indicates the Pheno plugin is actively preparing to intercept PC-to-phone synchronization tools for OTP theft.
Identifies the creation of specific web shell filenames associated with SHADOW-EARTH-053 within targeted IIS and Exchange Web application directories. This rule detects the creation of known web shell files in critical web server paths, indicating an adversary's attempt to establish persistent access and remote control over the compromised server.
This rule detects the creation, modification, or execution of files matching a predefined list of known malicious SHA256 hashes. It correlates file and process events to identify the presence and activity of these specific malicious artifacts on monitored systems.
This rule detects the creation of files matching the exfiltration pattern used by the Mini Shai-Hulud malware. Specifically, it looks for files named 'results-<timestamp>-<counter>.json' within a 'results' directory, accounting for both Windows and Unix path separators. This pattern is indicative of data staging or exfiltration activities by the malware.
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects the creation of the 'vector_notice.sh' script in the '/etc/profile.d/' directory. The VECT ransomware (Linux and ESXi variants) drops this shell script to display a ransom note to users upon shell login.
Detects the creation of 'vector_notice.sh' in '/etc/profile.d/', a shell script dropped by VECT ransomware on Linux systems to display its ransom note upon user login. This rule specifically looks for file creation events on Linux systems where the target file name matches the exact path '/etc/profile.d/vector_notice.sh'.
This rule detects the execution of SUID binaries by a non-root user, immediately followed by the creation of a persistence mechanism such as a systemd service file or a cron job. This correlation aims to identify potential privilege escalation attempts where an attacker uses an SUID binary to gain elevated privileges and then establishes persistence on the system.
Detects the creation of an executable file named 'sysd' in the '/usr/local/bin/' directory on Linux systems. The Nexcorium Mirai variant copies itself to this location to masquerade as a legitimate system process for persistence. This specific file name is not a standard Linux system daemon.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory, indicative of automated task deployment via Group Policy Preferences (GPP) commonly abused by adversaries. This activity can be used for persistence, privilege escalation, or lateral movement.
Detects file creation or modification events targeting /etc/systemd/system/persist.service, or the execution of 'systemctl enable persist'. This persistence mechanism is used by the Nexcorium Mirai variant to ensure the botnet survives reboots.
https://socket.dev/blog/bitwarden-cli-compromised
This rule detects the staging or execution of the LaxGopher payload, disguised as 'whisper.dll', by monitoring DLL loading and file writing events. It specifically looks for the filename 'whisper.dll' in ImageModuleLoad, PeFileWritten, or NewExecutableWritten events.
Identifies when the ScreenMeet.Support.exe RMM tool is downloaded on a host or initiates network connections. This rule detects file creation events for 'ScreenMeet.Support.exe' and network connections made by processes with 'ScreenMeet.Support.exe' as the initiating process filename.
Page 179 of 217