Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,534 detections
Filters
Last updated
All Time
Detection languages
2,471
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,439
11,829
5,873
5,151
4,864
4,534
Platforms
3,833
1,048
471
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,598
1,416
1,297
744
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects modification or creation of .htaccess files within WordPress directory structures followed within 24 hours by the creation or modification of .cache files in the same directory. This behavioral pattern is often indicative of web shell deployment or persistence installation via compromised web applications.
Detects a sequence of events indicative of Bring Your Own Vulnerable Driver (BYOVD) attacks or security control impairment. It monitors for the loading of a rare driver (seen on 3 or fewer hosts), accompanied by either the creation of a kernel service or defense tampering activities such as disabling security monitoring or stopping security-related services.
Detects the Shai-Hulud tensorlake payload pattern of fetching a platform-specific HackBrowserData binary and then executing it on the same host to dump browser-stored credentials. Anchored on tool behavior (download then execution on one host) rather than a single sample hash or the rotating C2 domain.
Detects the creation of persistence artifacts associated with the 'gh-token-monitor' service utilized by the Shai-Hulud worm across Linux systemd user services, macOS LaunchAgents, and Windows scheduled tasks or local application directories. This service acts as a dead-man's switch designed to wipe the user's home directory if the stolen GitHub token is revoked.
Detects creation of Windows registry hive files (ntuser.dat or UsrClass.dat) outside the expected user profile path hierarchy. LegacyHive writes a modified ntuser.dat to a GUID-named staging directory at C:\\ root (e.g. C:\\{GUID}\\ntuser.dat) and copies UsrClass.dat there as well to set up the oplock-based race condition. Any hive file materialising outside C:\\Users\\ or C:\\Windows\\ is a strong indicator of this exploit chain or equivalent offline hive manipulation.
Detects post-exploitation activity against Ivanti ICS / Connect Secure
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
Detects creation or modification of cron entries on the BeyondTrust
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Detects Play-style lateral movement via Group Policy: an executable (.exe/.dll) written to a SYSVOL/GPO path by the same non-machine account that modified a GPO in the same 30-minute window. Attackers use this to push ransomware or Cobalt Strike/SystemBC payloads domain-wide.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects creation of a JSP/JSPX/WAR server-side script inside
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
Detects creation of sitecustomize.py, usercustomize.py, or .pth path configuration files inside a site-packages or dist-packages directory by a python or pip process. These files are automatically loaded by Python's site module on every subsequent interpreter start, allowing a malicious package installer to establish persistence that re-executes on every future Python invocation without further victim interaction.
Detects creation of a JSP/JSPX/WAR server-side script inside
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects modifications or creations of the SCNotification.exe.config configuration file associated with the Microsoft Endpoint Configuration Manager (SCCM/ConfigMgr) client by processes other than approved system tools such as ccmsetup.exe, msiexec.exe, or CcmExec.exe.
The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download malicious tools, such as network scanners, for further exploitation. If confirmed malicious, this behavior could lead to network mapping, lateral movement, and potential compromise of additional systems within the network.
The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
Page 6 of 216