Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects unauthorized access (creation, modification, renaming, or deletion) to sensitive local credential files by the Node.js runtime process (node.exe/node). This behavior is indicative of infostealers, specifically noted in the Miasma/MYRA activity associated with the Polymarket Trap campaign, where malicious packages attempt to exfiltrate AWS, SSH, NPM, Python, Docker, and GPG credentials.
Detects file artifacts produced by the PostCSS typosquatting Windows RAT (abdrizak). Covers Chrome credential dump outputs (pwd.txt, chrome_logins_dump.txt), access to Chrome Login Data and Local State files by non-browser processes, and single-instance tracking files (.store, .host) written to the TEMP directory.
Detects the compilation or execution of the Exploitarium Nmap IPv6 ExtLen Wrap Proof-of-Concept harness. This detection monitors for the direct execution of known binary names and the g++ compilation process involving these specific source files.
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
Detects the creation of a hidden shell script file at '/etc/profile.d/.sh.local', a common persistence mechanism used by the MYRA RAT. This file is automatically executed by POSIX-compliant shells during the login process to maintain persistence on Linux systems.
This rule detects the execution or file interaction of known local AI/Large Language Model tools (e.g., Ollama, LM Studio, GPT4All) when initiated by non-interactive system processes (such as services.exe, svchost.exe, or lsass.exe) or under system/network service account contexts. This behavior is indicative of unauthorized local model staging or enumeration within a compromised environment.
Detects instances where processes not associated with standard web browsers (e.g., node.exe) attempt to create, modify, or rename browser-related sensitive files, specifically cookie databases and DPAPI-protected Local State files. Such activity is often indicative of credential and session cookie theft.
This rule monitors email attachment events for PDF files containing specific, repetitive text patterns often associated with phishing templates or document-based social engineering. It detects attachments that include phrases like 'lorem ipsum' variations or specific professional-sounding but potentially suspicious terms like 'Investor Accounts Producer' or 'Settlement Agreement' which may indicate an attempt to entice a user into reviewing fraudulent documentation.
Detects the LegionLoader infection chain, specifically identifying the use of dllhost.exe as a proxy to load malicious .cpl files or COM objects (e.g., COpenControlPanel) from AppData\Roaming. This rule correlates an initial msiexec.exe MSI staging event with the subsequent dllhost.exe execution and its child process spawn behavior within a 30-minute window.
Detects the execution of hidden shell scripts (.sh or .command) located within a mounted disk image (.dmg). This pattern is commonly used by macOS infostealers which masquerade as legitimate applications (such as Notion, Arc, or Raycast) to trick users into executing malicious code after mounting the deceptive installer.
Detects reconnaissance and C2 registration activity associated with the BeepRAT (DcRAT-derived) malware. The rule correlates registry queries, process execution (e.g., wmic, whoami, systeminfo), and file system activity related to the TCC loader chain, specifically focusing on how the implant gathers system hardware and user information to construct a unique client ID for command and control.
This rule detects the extraction of a file from an archive (RAR) using 7-Zip utilities, followed by the execution of a file (exe, dll, js, etc.) from the Temp or Downloads directory within 120 seconds. This pattern is commonly observed during the execution phase of a malicious payload delivered via archives.
Detects RTLO Unicode character used to disguise malicious file extensions
Detects the creation or execution of suspicious LNK files masquerading as legitimate AnyDesk or N-able RMM configuration files (e.g., ApplianceConfig.lnk, ServerConfig.lnk) and unauthorized access to AnyDesk service or user configuration files (anydesk_svc.conf, anydesk_usr.conf). This behavior is associated with MexicanMafia's 'Operation Escaneo' for establishing persistent, low-visibility remote access.
Detects the creation of files on web servers matching known Neo-reGeorg web shell tunnel variants. These files are typically used as backdoors to tunnel traffic and provide persistent access to the server.
Detects the abuse of the Windows built-in Certutil.exe utility for deobfuscating files or downloading remote content. This rule identifies common patterns associated with malicious activity, including the decoding of encoded files and the use of the urlcache flag to download remote files, which are techniques often used to bypass security controls and retrieve second-stage payloads.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.
Detects the 'Adblock for YouTube' browser extension (specific ID cmedhionkhpnakcndndgjdbohmhepckk) performing suspicious file system operations related to the injection of remotely-fetched scriptlets into the browser's MAIN world. This activity is indicative of an attempt to bypass browser security boundaries to access session cookies, local/session storage, and login form data.
Detects specific malicious Chrome extension IDs executing JavaScript in the 'MAIN' world context of visited web pages. This behavior bypasses the browser extension's isolated execution sandbox by using 'chrome.scripting.executeScript' combined with malicious server-fetched 'scripletsRules' or the 'trusted-create-element' scriptlet, enabling full DOM access and potential credential theft or cross-site scripting.
Detects the execution of the VNT tunneling tool disguised as a legitimate VMware executable (vmwared.exe) located in C:\ProgramData\VMware\. The rule also identifies the creation of a scheduled task named 'MicrosoftEdgeUpdate' configured to execute the masqueraded binary at user logon with elevated privileges.
Page 82 of 139