Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
This rule detects the creation or modification of a GitHub Actions workflow file named 'discussion.yaml' within the '.github/workflows/' directory. This is a known persistence technique used by the Shai-Hulud 2.0 worm to register an infected machine as a self-hosted runner, allowing attackers to execute arbitrary commands.
This query identifies an anomalous pattern associated with behavior performed by NotDoor to establish persistence and avoid its detection.
Detects screenshot files being created in temp directories by Node.js processes. OtterCookie captures multi-monitor screenshots and stores them as JPEG files before exfiltration.
Detects host-based artifacts associated with AK47/X2ANYLOCK ransomware, such as the creation of specific ransom notes ('How to decrypt my data.txt', 'How to decrypt my data.log') or files being encrypted with the '.x2anylock' extension. This rule identifies both the creation of the ransom note and the encryption of files by monitoring file creation and renaming events.
Detects the creation of files associated with NPM packages compromised in the "Sha1-Hulud: The Second Coming" campaign. This is a broad query intended for hunting and requires manual verification of package versions.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects the creation of files with double extensions (e.g., .pdf.rar, .txt.exe), a technique used by the Water Gamayun APT group to disguise malicious payloads.
Detects the FormBook RAT persistence mechanism where it copies itself to a disguised location (%APPDATA%\Roaming\word\word.exe) and creates a registry run key named 'svchost.exe' to ensure execution at user login. The rule correlates the file creation and registry modification events on the same device within a short time window.
Detects the creation of image files on endpoints that match the characteristics of the LANDFALL Android spyware delivery mechanism. LANDFALL is delivered via malformed DNG/JPEG files, often through WhatsApp. This activity could represent a user downloading or staging the malicious file on a corporate endpoint before transferring it to a mobile device. The rule looks for specific filename patterns associated with WhatsApp and known malicious file hashes.
Detects the creation of VBScript or Batch files in the Windows Startup folder. This is a common persistence technique used by various malware families, including the scripts (`pws1.vbs`, `PWS.vbs`, `startuppp.bat`) dropped by the SERPENTINE#CLOUD campaign.
Detects the initial execution phase of the CHAMELEON#NET campaign, where specific obfuscated JavaScript files (e.g., POP2.js, adobe.js, svchost.js) are dropped into a temporary directory and then executed by a script host like wscript.exe or cscript.exe. The rule correlates file creation events of these suspicious JavaScript files in the user's temporary directory with their subsequent execution by wscript.exe or cscript.exe within a short timeframe.
Detects the creation or loading of the LANDFALL spyware's SELinux policy manipulator component (`l.so`). This component is used to gain elevated permissions and persistence on compromised Samsung Android devices. The rule identifies the component by its known hash or by its specific file name and path (`/data/data/com.samsung.ipservice/files/l.so`).
Detects the creation of files in a directory known to be created by a malicious NSIS installer associated with the RONINGLOADER campaign.
Detects the creation or modification of files, particularly shared objects (.so), on Android devices with overly permissive '777' (rwxrwxrwx) permissions. This behavior is a known tactic of the LANDFALL spyware, which sets these permissions on its staged components like 'dec_a.so' to ensure they are executable.
Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.
Detects the creation or modification of .plist files in macOS Launch Agent and Launch Daemon directories. This activity can be indicative of persistence mechanisms being established by adversaries. The rule excludes modifications by common system installers to reduce false positives.
Detects a creation of systemd services which could be used by adversaries to execute malicious code.
Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
Detects activity associated with the Hannibal Stealer, a .NET info-stealer known for targeting cryptocurrency wallets, VPN configurations, and browser data.
This query hunts for .lnk (shortcut) files that are either newly created or have the hidden attribute set, located in common Windows startup folders. Attackers often place LNK files in these locations to establish persistence.
Page 191 of 216