Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects potentially malicious data exfiltration activity. It identifies sequences of events where a process performs file enumeration (directory listing), followed by the creation of a ZIP or RAR archive in temporary or local application data directories with randomized filenames. Finally, it correlates this behavior with subsequent outbound network connections from the same process to known cloud storage and file-sharing providers, flagging anomalous archive creation rates.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
Detects attempts to escape a Docker container to the host filesystem by exploiting directory traversal vulnerabilities within the 'docker cp' command. It identifies suspicious CLI arguments indicating path traversal, the presence of known PoC artifacts, and file write events initiated by the Docker daemon outside of expected container directory paths.
Detects instances where ImageMagick (magick.exe or convert.exe) spawns Ghostscript (gswin64c.exe, gswin64.exe, or gs.exe) from a directory other than the standard Ghostscript installation path. This behavior is indicative of a search order hijack where an attacker places a malicious binary in a location searched before the legitimate Ghostscript installation.
Detects mshta.exe spawning from archive utilities (winrar.exe, 7z.exe) or Windows Explorer, or executing HTA files directly from common user-writable temporary or download directories. This pattern is commonly associated with the execution of malicious payloads delivered via compressed archives, a technique observed in campaigns attributed to the Turla threat group.
Detects the loading of 'mscoree.dll' or 'msvcp140.dll' from the 'C:\ProgramData\' directory by processes masquerading as '.NET Runtime Optimization Service' or originating from a highly suspicious, obfuscated folder path. This behavior is indicative of malware attempting to evade detection through DLL side-loading or process masquerading, as legitimate .NET Runtime Optimization Service processes should not load these DLLs from this location or from such unusual paths.
USB worm and loader leveraging living-off-the-land binaries
Cloud extortion group exploiting exposed credentials and storage
Fraud framework powering scam domains for crypto and gambling schemes
Ransomware group exploiting edge devices and managed file transfer software
This rule detects potential DLL sideloading activity associated with the SHARDLOADER implant, commonly linked to the threat actor Mustang Panda. It monitors for suspicious executable names (e.g., Project Proposal.exe) loading malicious DLLs (SolidPDFCreator.dll, ctxmui.dll) or interacting with specific staging directories in ProgramData or User Public folders, typical of their TTPs targeting government and energy sectors.
Detects unauthorized modifications to FreeBSD init scripts located in /etc/rc.d/, /usr/local/etc/rc.d/, or /etc/rc.subr. These directories are used for system service startup. The rule specifically monitors for modifications related to the BRICKSTORM persistence mechanism, which targets these scripts to execute malicious binaries such as /usr/local/libexec/ipsec/blacklist.
Detects the simultaneous creation of specific Windows Defender quarantine artifacts (C:\Windows\Temp\tmp[16 chars]) and RP_ staging directories, which is indicative of the RoguePlanet race condition exploitation technique. This activity involves leveraging ReadDirectoryChangesW to synchronize file operations and bypass security controls.
Detects the presence of files known to be associated with malicious activity by matching their SHA256 hashes against a list of known bad indicators.
Detects instances where a digitally signed executable loads a DLL file from a user-writable directory (e.g., AppData, Downloads, Temp). This is a common technique used by threat actors, such as in TA4922 campaigns, to execute malicious payloads (e.g., Atlas RAT or ValleyRAT) by sideloading them into a trusted process, effectively bypassing application allow-listing and environment security controls.
Detects Payouts King ransomware activity by identifying file rename events to the .ZWIAAW extension or the creation of the 'readme_locker.txt' ransom note on any disk path. The rule specifically accounts for file operations that might utilize techniques like SetFileInformationByHandle for evasion.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
This rule detects the presence of Phoenix malware by identifying known SHA256 hashes of its components or network connections to its command and control (C2) infrastructure. It correlates file events with known malware hashes and network events with known C2 IP addresses.
This rule detects suspicious activity based on a set of Indicators of Compromise (IOCs) including malicious IP addresses, domains, URLs, and file hashes (SHA256). It monitors network connection events for communication with known malicious IPs, domains, or URLs, and file/process events for the execution or presence of files with known malicious SHA256 hashes.
Detects the use of package management or file integrity monitoring tools (rpm, dpkg, debsums, aide, inotifywait) to verify or interact with critical SSH/PAM configuration files, or the use of inotifywait to monitor SSH configuration access. This behavior may indicate an adversary attempting to verify compromised configurations, check for the presence of backdoors, or monitor security modifications.
This rule detects modifications (such as write, rename, create, or delete events) to critical Linux system files including SSH binaries (sshd, ssh, scp) and PAM authentication modules (pam_unix.so). These files are common targets for adversaries seeking to establish persistence, bypass authentication mechanisms, or gain unauthorized access to credentials.
Page 77 of 139