Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,534 detections
Filters
Last updated
All Time
Detection languages
2,471
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,439
11,829
5,873
5,151
4,864
4,534
Platforms
3,833
1,048
471
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,598
1,416
1,297
744
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects script execution (such as wscript, cscript, mshta) spawned from a shell parent process (like explorer.exe or cmd.exe) referencing browser cache files (matching f_* in browser profile directories) or copying scripts to the local Temp directory as t.vbs.
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects potential bootkit activity or unauthorized modifications to the EFI system partition by correlating non-standard .efi file writes with subsequent execution of boot configuration utilities like bcdedit or mountvol within a 30-minute window.
Detects a sequence where a FortiSIEM-related process writes or modifies a shell script in a cron or phoenix directory, followed closely within 2 minutes by a child process spawned by cron executing that same written script file.
Detects when a USB mass storage device is connected to a host and is followed shortly thereafter by a large volume of file creations or modifications on a removable drive, which may indicate data exfiltration or staging.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects PowerShell processes spawned via shortcut files (lnk) using suspicious command-line parameters that subsequently create both a text file and a Discord-named executable on the same device within a 10-minute window.
Detects a PHP file being written into a WordPress content directory
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
Detects persistence mechanisms established via Registry Run/RunOnce keys, Startup folder modifications, or scheduled task creation using specific tool names such as client32 or pcictlui.
Detects hosts with the trojanized version 3.0.123 of the Rank Math PRO WordPress plugin distributed in October 2026. It correlates software inventory, file events, command-line process events, and network connections to identify affected packages, installation activity, and C2 communications.
Detects a high volume of file creation events (greater than 200 files) on an external USB mount session by a non-system account, which may indicate potential data exfiltration or staging to removable media.
Detects a file creation event for any executable inside the "tmphtml" staging
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
Detects a file creation event for any executable inside the "tmphtml" staging
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects the WinLol Rust dropper staging a DLL sideload by writing a copy of Microsoft OneDrive.exe and a proxy version.dll into a user temp directory by a non-OneDrive, non-installer process.
Detects PowerShell execution involving Base64 decoding or certutil decoding combined with writing files to the AppData directory using .NET I/O methods or PowerShell cmdlets.
Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.
Page 4 of 216