Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects the creation or modification of cron files or files within standard cron directories on Linux systems. Adversaries often abuse the cron utility to establish persistence or schedule malicious tasks for execution at specific times or intervals. Monitoring these file events can help identify unauthorized scheduling of tasks.
Detects the creation of files commonly associated with Godzilla-forked webshells, such as 'error.aspx', on a web server. Threat actors deploy these webshells for persistent access after exploiting vulnerabilities in web applications like IIS.
This rule detects the creation of temporary files within the WebDAV TfsStore directory that have suspicious file extensions. Attackers can leverage WebDAV to force authentication or to drop malicious files onto a system. The presence of executable or archive file extensions in this specific temporary directory is highly indicative of malicious activity, potentially related to initial access or resource development.
This rule detects the creation of new files within the Microsoft Windows Defender program data folder. It specifically looks for file creation events where the initiating process is not a known, whitelisted Defender process. This behavior could indicate an attempt to tamper with or exploit Windows Defender, potentially to impair its defensive capabilities or to hide malicious activity.
Detects the creation of suspicious files associated with Proof-of-Concept (PoC) exploits targeting the Windows Print Spooler Remote Code Execution Vulnerabilities, specifically CVE-2021-34527 (PrinterNightmare) and CVE-2021-1675. The rule looks for file creations within the ':\Windows\System32\spool\drivers\x64\' directory, which is a known location for files dropped by these exploits.
Detects the use of PowerShell to decode a Base64 encoded string and write it to the filesystem. This technique is used by adversaries, including in the PassiveNeuron campaign, to drop web shells or other malicious payloads.
Detects potential exploitation of the ToolShell remote code execution vulnerability (CVE-2025-53770) in on-premises Microsoft SharePoint servers. Attackers have been observed sending POST requests to the 'ToolPane.aspx' endpoint and subsequently dropping webshells with specific names in the SharePoint LAYOUTS directory.
KQL Query
Detects potential exploitation of the critical SharePoint “ToolShell” zero‑day vulnerability (CVE‑2025‑53770), in which attackers leverage unsafe deserialization of untrusted data in SharePoint’s ToolPane.aspx endpoint to achieve unauthenticated remote code execution via IIS worker process behavior.
Detects the deployment or activity of the TOLLBOOTH IIS module. This is achieved by identifying the creation of its specific DLLs by the IIS worker process (w3wp.exe), or by detecting outbound C2 communication from the IIS worker process to known TOLLBOOTH infrastructure.
This rule detects the creation of new files within the `/etc/sudoers.d/` directory. Files in this directory can be used to grant specific users or groups elevated privileges without requiring a password, serving as a persistence mechanism for attackers to maintain privileged access.
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324, potentially leading to webshell deployment.
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware. This indicates that a system is actively being encrypted by this specific ransomware.
Detects attempts to create a DLL file in known desktop application dependencies folders (e.g., Slack, Teams, OneDrive) by an unusual process. This activity may indicate an adversary attempting to load a malicious module via DLL search order hijacking for persistence, privilege escalation, or defense evasion.
Detects the creation of files named "ebpfbackdoor" within the "cron.d" and "sudoers.d" directories. This activity is associated with the TripleCross eBPF rootkit, which uses these locations for persistence.
Detects the creation of a macro file for Outlook, specifically 'VbaProject.OTM', which can be used for persistence or to execute malicious code when Outlook is launched.
Detects the creation of suspicious files (jsp, java, class) in specific SAP NetWeaver directories. This activity may indicate an attempt to establish a webshell or exploit vulnerabilities, such as CVE-2025-31324, to gain persistent access or execute arbitrary code within the SAP environment.
This rule detects the creation of new systemd service unit files in standard systemd directories. Adversaries often create or modify systemd services to establish persistence or escalate privileges by executing malicious code at system startup or when specific events occur. The rule specifically looks for file creation events in '/usr/lib/systemd/system/', '/etc/systemd/system/', and user-specific '/.config/systemd/user/' directories, which are common locations for systemd unit files.
This rule detects the creation of an executable named 'Get-Variable.exe' within the 'Local\Microsoft\WindowsApps\' directory. This is a suspicious activity because 'Get-Variable' is a legitimate PowerShell cmdlet, not an executable. Adversaries can exploit the Windows application execution alias feature, where executables in the WindowsApps directory can be prioritized over PowerShell cmdlets with the same name. By placing a malicious 'Get-Variable.exe' in this path, an attacker can trick the system into executing their malicious binary instead of the intended PowerShell cmdlet when 'Get-Variable' is invoked, leading to persistence or privilege escalation.
This rule detects the creation of files with a '.scr' extension, which are typically Windows screensaver executable files. Adversaries may create or modify these files to establish persistence by executing malicious content when user inactivity triggers the screensaver. The rule includes filters to reduce false positives from known legitimate processes creating screensaver files, such as Kindle.exe, Symantec Endpoint Protection's ccSvcHst.exe, and TiWorker.exe creating uwfservicingscr.scr.
Detects the creation of the 'shai-hulud-workflow.yml' file, which is associated with the Shai Hulud worm. This worm targets the NPM supply chain and is designed to exfiltrate GitHub secrets. The rule specifically looks for the creation of this file within the '.github/workflows/' directory.
Page 193 of 216