Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects known malicious file hashes associated with the VoidLink malware framework.
Detects AI/ML model configuration files (e.g., config.json, model_config.yaml) containing a suspicious '_target_' value, which could indicate an attempt to exploit a Hydra instantiation vulnerability for remote code execution (RCE).
Detects file creation events for specific files downloaded by the Turla Kazuar v3 loader. The malware downloads a set of files into the %LOCALAPPDATA%\Programs\HP\Printer\Driver directory including hpbprndi.exe (a legitimate signed Hewlett-Packard printer driver installer used as a loader with SHA256: 34b7df7919dbbe031b5d802accb566ce6e91df4155b1858c3c81e4c003f1168c), hpbprndiLOC.dll (the actual Kazuar v3 loader DLL that implements COM-based.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
This rule detects indicators associated with the 'Office Assistant' supply chain attack. It identifies malicious browser extensions by their IDs in file paths or names, and also detects known malicious file MD5s and C2 communication domains. The rule correlates file events and network events to provide a comprehensive view of the attack.
Detects the presence of specific Chrome, Edge, or Firefox browser extension IDs associated with the DarkSpectre Zoom Stealer malware. This rule aims to identify compromised systems exhibiting the installation artifacts of the malicious browser extensions.
This rule detects the presence of known malicious browser extensions, specifically "Zoom Stealer Extension" and "Shady Panda Extension", by looking for their unique Extension IDs within file paths or file names on devices. It identifies the first and last seen timestamps, the names of the extensions, their IDs, associated campaigns, and the browsers they target, summarizing this information per device.
Detects the creation of DLL files named with a GUID pattern in common staging directories. This technique was observed being used by the threat actor UKC-1230 to drop surrogate COM DLLs for persistence.
Detects .wsb configuration files created in common staging directories used by attackers for malware deployment.
Detects code.exe file creation in non-standard locations such as user home directories or temp folders, indicating potential staging of VS Code CLI for malicious purposes
Detects malicious browser extensions associated with the DarkSpectre 'Zoom Stealer' campaign by identifying known malicious extension IDs. The campaign uses these extensions for corporate espionage by stealing meeting intelligence from various video conferencing platforms.
Timestomping Detection
Cortex XDR
This rule detects potential timestomping activity by identifying files where the creation time is later than the modification time. This behavior can indicate an adversary attempting to manipulate file timestamps to evade detection or forensic analysis. The rule specifically targets executable and script file extensions.
This rule detects the presence of known malicious browser extensions, specifically Urban VPN, Urban Browser Guard, Urban Ad Blocker, and 1ClickVPN Proxy, across Chrome and Edge browsers. It identifies these extensions by searching for their unique 32-character Extension IDs within file paths or file names associated with device file events. The rule then enriches the findings with the extension's name and the browser it belongs to.
Detects the presence of a file with a specific SHA-256 hash associated with a Linux Sliver TCP Pivot implant. This implant has been linked to the CL-CRI-1036 group and is used as a precursor to 01flip ransomware deployment. The rule searches across file and process events for this high-fidelity indicator of compromise.
Detects the renaming of VMware virtual machine related files to a new file ending with the '.emario' extension. This behavior is characteristic of the RansomHouse 'Mario' encryptor.
Detects files associated with the Cl0p ransomware group's exploitation of the Oracle E-Business Suite vulnerability (CVE-2025-61882).
This rule detects suspicious network connections to known malicious URLs associated with a Docker Desktop malware campaign. It also identifies instances where 'DockerDesktop.exe' is executed or present in unusual file paths, suggesting potential masquerading or unauthorized deployment outside of its standard installation directory. The rule is broken into three parts: network events, file events, and process events. The network part looks for connections to specific malicious domains. The file and process parts look for 'DockerDesktop.exe' in folders other than the assumed legitimate installation path, indicating potential malicious activity.
Detects the renaming of critical virtualization files by the RansomHouse 'Mario' encryptor, which appends an extension containing '.mario' (e.g., '.emario'). This activity is a strong indicator of a successful encryption event on an ESXi host.
Detects the ZinFoq Go-based post-exploitation implant. This rule identifies the binary based on a unique, hardcoded timestamp string used for its timestomping anti-forensics feature, along with other specific C2 artifacts.
Detects indicators of compromise (IOCs) associated with the GOLD BLADE threat group's July 2025 campaign, including file hashes and C2 domains.
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
Page 110 of 139