Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects Node.js processes (node, npm, npx) accessing or modifying '.npmrc.bak' or '.npmrc' files located within 'node_modules' directories. This activity is indicative of credential theft, specifically targeting potentially active npm authentication tokens that might have been inadvertently backed up or exposed within project directories.
This rule detects a high volume of access attempts (10 or more within an hour) by a single user to sensitive system directories such as 'Admin' or 'System32'. This behavior could indicate an adversary performing file and directory discovery, attempting to access sensitive files, or staging for further malicious activity.
Detects the presence of file artifacts associated with known keyloggers (keylogger.dat, remcos.log) or files containing 'keylog' within the AppData\Roaming directory, which is a common persistence location for malware.
Detects Remcos RAT establishing persistence by writing to Windows Registry Run keys from processes executing out of AppData, Temp, or ProgramData directories. The rule specifically looks for registry modifications in Run or RunOnce keys where the image path or the value details point to suspicious, writable directories commonly abused by malware.
Detects persistence mechanisms used by the MYRA Linux RAT, specifically targeting the modification of /etc/ld.so.preload, the deployment of a malicious library (.libcache.so) to /usr/local/lib/, and suspicious shared object file creation in temporary directories (/tmp or /dev/shm) initiated by Node.js or npm processes. This behavior was observed in the Polymarket Trap npm supply chain campaign.
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
Detects Covenant Grunt Stager modules used by APT28 in the Phantom Net Voxel campaign based on known file hashes.
Detects LCRYX ransomware activity by monitoring wscript.exe or cscript.exe executing mass file renames with the .lcryx extension and the creation of PLEASEREADME.txt ransom notes within sensitive user directories.
This rule detects the creation of 'system.dll' or 'shfolder.dll' files within Windows or AppData temporary directories. These specific filenames are frequently associated with DLL sideloading or search order hijacking techniques where malicious DLLs are masqueraded or placed in writable user-space folders for execution by legitimate processes.
Detects WinRAR executing with archiving flags (create, add, move) on sensitive paths, followed by an outbound network connection to a non-private IP address within a 10-minute window, which is characteristic of data staging and exfiltration.
This rule detects activities associated with specific malicious browser extensions, often masquerading as ad blockers. It monitors for file and command-line references to the unique extension IDs associated with these malicious payloads and also alerts on DNS requests directed at C2 domains known to be used by these extensions.
Detects the presence or installation of known malicious Adblock for YouTube browser extensions. These extensions are flagged for utilizing overly broad host permissions (e.g., <all_urls>) in conjunction with webRequest and scripting capabilities, which facilitates cross-site data collection, potential session hijacking, and the injection of malicious remote scripts.
This rule detects the installation or update of known malicious browser extensions followed by network communication to identified command-and-control or malicious infrastructure domains. It also monitors for direct network beaconing to these malicious domains, providing defense-in-depth even if installation telemetry is absent.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
Detects the creation of specific files ('Mixed Reality.exe' or 'nvdaHelperRemote.dll') within the 'C:\Program Files\Windows Media Player\' directory. This activity is a known technique used by the threat actor group associated with Operation DragonReturn (Silver Fox) to stage DLL sideloading, facilitating the persistence of malware such as DcRAT or XenoRAT.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects the creation of synchronization objects with names matching specific patterns often associated with malicious setups or obfuscated file naming conventions. It joins these object creation events with process rollup data to provide context on the originating process, including command line arguments and file paths.
Detects unauthorized processes attempting to read, modify, or create files within common browser credential locations (Chrome, Firefox, Edge, and Windows Credential Manager). Legitimate browser processes and their known signers are excluded, focusing on suspicious secondary processes or tools frequently utilized by infostealers like Lumma and RedLine to dump credentials.
This rule detects potential DLL sideloading by identifying signed executables that load unsigned DLLs from user-writable directories, such as Temp, AppData, Downloads, or Documents. It excludes loads from standard, protected Windows directories to reduce noise.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
Page 88 of 139