Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects instances where common shell or command-line tools are spawned by Amazon Q processes (amazonq-language-server) or development-related processes (Code.exe, node) shortly after the creation or access of the 'mcp.json' configuration file within an '.amazonq' directory. This behavior may indicate an attacker using development tool vulnerabilities or compromised extensions to execute arbitrary commands.
Detects the creation of executable files (.exe, .com, .scr, .vbs, .js) that contain financial-themed keywords (e.g., GST, NEFT, RTGS, IMPS, Banking) in their filename. This pattern is commonly used in social engineering and phishing attacks to trick users into executing malicious payloads disguised as legitimate banking or financial documents.
Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk.
This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.
This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.
Detects LOLBINs and applications that should not legitimately drop script files to disk.
This may indicate malware staging or abuse of a trusted binary for script-based code execution.
This may indicate malware staging or abuse of a trusted binary for script-based code execution.
Detects the post-encryption cleanup routine where Nightspire utilizes wevtutil to clear Security, System, and Application event logs to hinder incident response efforts. This rule specifically looks for the execution of 'wevtutil.exe' with the 'cl' (clear log) command targeting 'System', 'Security', or 'Application' event logs, and correlates it with the presence of files ending with '.nightspire' on the same device.
This rule detects the suspicious behavior where the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library into memory without any corresponding file creation or modification events for that DLL. This pattern is indicative of reflective code loading or fileless execution techniques often associated with Backdoor.Mistic (MLTBackdoor), where malicious code is executed directly from memory to evade disk-based security controls.
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
This rule detects executable files being created or launched within the 'AppData\Local\Programs' directory by a temporary-stage process. This behavior is often indicative of malware attempting to establish persistence or execute from a user-specific location, leveraging temporary directories for initial execution or staging.
Detects the silent extraction of ZIP archives using the native Windows tar.exe utility into application data directories. This behavior is indicative of the Potemkin Loader, where attackers stage malicious payloads following an initial download to evade detection.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Rust-based macOS infostealer implant embedding prompt injection payloads
AI-powered phishing-as-a-service abusing device-code authentication
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Rust-based ransomware family targeting enterprise environments
Credential and browser data stealer distributed via OXLOADER campaigns
Detects instances of wermgr.exe (Windows Error Reporting) interacting with Volume Shadow Copies or using specific Alternate Data Streams (WDFOO). This behavior is often associated with credential dumping tools (e.g., Mimikatz, SharpShadow) attempting to access sensitive files from shadow copies under the context of a non-system user, potentially indicating evasion techniques or credential harvesting.
Detects anomalous activity associated with 'winupdate.exe', including suspicious registry run key persistence, execution from abnormal directories (e.g., AppData, .cache), and unauthorized outbound network connections to Pastebin. The rule triggers when multiple signals are observed from the same host and user, indicating potential malware behavior.
Page 85 of 139