Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of a 'startup.js' file in specific, non-standard subdirectories used by the Lazarus Group's 'Graphalgo' campaign to stage malicious payloads. These paths mimic legitimate application folders to evade detection.
Detects the creation of a JavaScript file in unusual subdirectories of the Google Chrome user data or application support folders. This behavior was observed in the 'graphalgo' campaign by the Lazarus Group to stage second-stage payloads.
Detects the execution of Active Directory enumeration tools (ADRecon, ADExplorer) that result in the creation of 'ComputerSPNs.csv'. Muddled Libra uses this file to identify critical services (Veeam, MSSQL, Exchange) for targeting via their Service Principal Names (SPNs).
Detects the creation of a mutex with a persistent suffix '!&fse?%AS!'. This string has been observed across multiple versions and campaigns of OysterLoader (also known as Broomstick/CleanUp).
Detects the creation of specific files ('result', 'result.kerb') in common user folders. These filenames are known artifacts of tools like GoSecretsDump used to decrypt the NTDS.dit database, a technique observed in Muddled Libra's playbook after they exfiltrate the database from a Domain Controller.
This detection identifies potential abuse of the Windows Package Manager (winget.exe) for malicious activities, including arbitrary command execution, execution from temporary directories, suspicious network egress, and installation of unsigned binaries from non-admin accounts.
This rule detects the deployment and potential abuse of Velociraptor, a DFIR (Digital Forensics and Incident Response) tool. It identifies Velociraptor by monitoring file creation/modification in common installation paths and for its executable name, process execution, and the creation of suspicious child processes (like PowerShell, cmd, curl, wget) by Velociraptor. The rule also attempts to correlate these activities to determine the severity of the detection, indicating potential post-exploitation activity.
This detection identifies the execution of a process from a directory that also contains a zero-byte file named 'pic1.png'. This specific behavior is a known execution guardrail for the 'Diaoyu' loader, used by the TGR-STA-1030 group to evade automated sandbox analysis.
This rule detects the creation of a zero-byte file named 'pic1.png' followed by the execution of any process from the same directory within a specified time window. This behavior is indicative of the DiaoYu Loader, which uses a zero-byte 'pic1.png' as a guardrail or check before executing its malicious payload.
Detects known malicious file hashes associated with the Clawdbot VS Code extension malware. This includes the weaponized ScreenConnect installer (Code.exe) and the Rust-based loader (DWrite.dll).
Detects the execution of an NSIS installer associated with the Silver Fox APT, which drops a legitimate executable (Thunder.exe) and a malicious DLL (libexpat.dll). This activity is the initial stage of the Silver Fox infection chain.
Detects when a web browser process creates a high-risk file type (e.g., ISO, ZIP, EXE). This behavior is a strong indicator of HTML smuggling (T1027.006), where a malicious payload is decoded from an HTML file and written to disk by the browser itself to evade network security.
Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
Detects the creation of specific directories (Bluetooth, ProShow, Adobe\Scripts) in the AppData folder by the Notepad++ updater (GUP.exe), a behavior associated with the Chrysalis backdoor persistence mechanism.
Detects the creation of a symbolic link or junction point by a non-elevated process where the target is a critical system file or directory. This is a key step in exploits like CVE-2025-0921, where a privileged process is tricked into writing to a sensitive location by following a malicious link.
Detects the DKnife gateway-monitoring framework, a toolset used by China-nexus actors for adversary-in-the-middle (AitM) attacks, based on specific file, network, and persistence artifacts.
Detects the creation of specific files in AppData paths associated with the second and third infection chains of the Notepad++ supply chain attack. These files are related to Lua script execution and DLL sideloading for persistence and execution.
This rule detects potential malware execution and persistence by correlating suspicious script and HTA activity with known malicious infrastructure. It flags mshta, wscript, and cscript executing remote HTA or script content, related network connections and downloads, temporary file artefacts, connections to listed suspicious domains and IPs, attempts to add Windows Defender exclusions, and fake browser update style process launches that retrieve executables over HTTP.
This rule detects the creation of 'rclone.conf' file on a device. The 'rclone.conf' file is a configuration file used by the Rclone utility, a command-line program for syncing files with various cloud storage services. The presence of this file often indicates the installation or use of Rclone, which can be leveraged by adversaries for data exfiltration to cloud storage.
This rule detects outbound network connections to command and control (C2) domains and identifies files by name or hash associated with malicious PDF editor campaigns (e.g., ConvertMate, PDFClick, PDFSkills). These campaigns use malicious PDF editors for C2 communication, to download additional payloads, and for initial execution.
Page 187 of 216