Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This detection identifies the presence of PromptLock ransomware by looking for known malicious file hashes (SHA1 and SHA256). PromptLock is reported to be the first AI-powered ransomware, written in Go, and uses a local AI model to generate malicious Lua scripts. The rule searches across both file and process creation events for wider coverage.
No description available.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
This rule detects suspicious activities related to Remote Monitoring and Management (RMM) tools by querying various data sources. It identifies processes, file signatures, network connections, and firewall logs associated with known RMM tools and domains, helping to uncover potential security threats. The rule leverages an external IOC list for RMM tool names, file signatures, and associated domains.
This rule monitors for the mounting of USB drives on a specific device. It aims to detect unauthorized data exfiltration attempts, audit physical device access, investigate insider threats or policy violations, and track removable media usage for compliance purposes.
This Logic detects the presence of the malicious Chrome extension FreeVPN.One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
This rule detects communication with known malicious domains and IP addresses, as well as the presence or execution of files with known malicious MD5 or SHA256 hashes. It correlates threat intelligence with network and endpoint telemetry to identify compromised devices or accounts.
This rule identifies potentially suspicious signed binaries by looking for files with digital signatures from signers that are not commonly known or trusted vendors. It aims to detect the abuse of code signing certificates by threat actors to bypass security controls, leveraging the trust associated with digital signatures. The rule explicitly excludes a list of well-known and trusted software vendors to reduce false positives.
This rule identifies potentially suspicious signed binaries in the environment by looking for files signed by 'OneStart Technologies LLC' and excluding common, known good vendors. This helps detect the abuse of code signing certificates by threat actors to bypass security controls and can support threat hunting and malware analysis.
This rule identifies file download events initiated by common web browsers such as Microsoft Edge, Internet Explorer, Google Chrome, and Mozilla Firefox. It can be used for hunting suspicious file downloads on devices, especially after an incident alert, or for general threat hunting.
This query hunts for files shared by a specified malicious sender on user devices. It identifies if attachments from emails sent by the malicious sender have been downloaded, saved, or are present on the user's devices by joining email attachment information with device file events based on the SHA256 hash of the attachment.
Detects the creation of keylogger output files by the WinMainSvc component, which is associated with the Crypto24 ransomware group. The keylogger runs as a service via svchost.exe and creates log files in the C:\Windows\tmp\ directory with a specific naming pattern.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Detects the NodeInitRAT NodeJS backdoor script used by the Mocha Manakin threat actor. This rule identifies specific strings related to C2 communication, persistence mechanisms, and command execution found within the script.
Detects the dual-use tool ADExplorer writing a complete Active Directory snapshot into a .dat file. This activity can be leveraged by attackers for various purposes, including data extraction for tools like Bloodhound, gathering usernames for password spraying attacks, or utilizing metadata for social engineering. While the snapshot typically does not contain password hashes, there have been instances where administrators inadvertently stored passwords in comment fields within Active Directory, which could then be exposed through such snapshots.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
This rule detects the presence and activity of PAM-based backdoors on Linux systems by looking for specific SHA256 hashes and filenames associated with known PAM backdoors. It monitors process events, general device events, file events, and image load events on Linux devices.
This query identifies browser extensions with a low global prevalence, which could indicate a malicious or unwanted extension. It specifically looks for .crx files created in "Webstore Downloads" folders and enriches the data with file prevalence information.
Akira SonicWall Campaign - Detects the creation or presence of malicious drivers (hlpdrv.sys, rwdrv.sys) or the creation of their associated Windows services.
Detects and logs file creation events triggered by the FunkLocker ransomware executable across all monitored systems, enabling early identification of malicious activity and facilitating rapid incident response.
Detects files based on common ransomware file extensions or ransom note filenames. This rule is based on a community-sourced list and is intended for broad detection.
Page 115 of 139