Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the presence of known malicious browser extensions (BadBlocker ecosystem including 'Adblock for YouTube') on endpoints by monitoring browser registry keys and file system locations. These extensions are known to contain dormant capabilities for arbitrary JavaScript execution and have been removed from the Chrome Web Store.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Detects the execution of 'msiexec.exe' where the installer package is located in suspicious or user-writable directories such as AppData, Temp, or Downloads. It specifically targets MSI files that do not follow standard naming conventions or use suspicious filename patterns, which is a common indicator of dropper or delivery behavior by adversaries.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
Detects the creation or usage of specific DLLs and batch files within a directory path containing 'Traiolx Custom Utils'. This pattern often suggests the deployment or execution of components related to specific tools or potentially malicious software, leveraging DLL side-loading or path-based execution.
Detects suspicious files, modules, or batch scripts executed from or staged within AppData Roaming directories, specifically targeting known patterns such as custom utils folders, DLL sideloading impersonation (e.g., 7z.dll, normaliz.dll), and Python C2 module components.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects the presence of a known malicious Chrome extension (ID: flkebkiofojicogddingbdmcmkpbplcd) or its associated files (e.g., rules.json, background.js) within browser extension storage directories on managed Windows endpoints. This rule monitors for file activity related to browser extensions that may have been deployed via malicious means to steal credentials or establish persistence.
Detects activity associated with the BeepRAT keylogger plugin by monitoring for specific command-line strings and file artifacts identified in the DcRAT-derived BeepRAT framework.
Detects instances where the 7z.exe process launches an executable or script file, often indicative of an adversary bypassing Mark-of-the-Web (MotW) protections by manually extracting malicious payloads from a downloaded archive.
Detects the establishment of persistence via Registry Run keys, Scheduled Tasks, or Windows Services, where the executed file or binary path is located in suspicious directories such as AppData, Temp, or ProgramData. This indicates potentially malicious code staged in temporary or user-writable locations to maintain access.
This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.
Detects instances where a process not associated with a known web browser attempts to read sensitive browser credential stores (such as Chrome Login Data, Edge Login Data, or Firefox key4.db/logins.json). This behavior is characteristic of infostealers attempting to extract saved browser credentials.
This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.
Detects instances where a signed process loads a dynamic-link library (DLL) from a user-writable directory, such as Temp, AppData, Downloads, or Public. This behavior is a common technique used for DLL sideloading to hijack the execution flow of trusted, signed applications.
Detects an executable creating a copy of itself in the current user's Startup folder by comparing the target name or hash with the initiating process. This method is often used by malware to establish persistence and regain execution when the user signs in.
Identifies the Potentially Unwanted Program (PUP) forcibly modifying Chrome or Edge extension directories or registry preferences to inject malicious stealers. This rule specifically looks for file creation or modification events within browser extension folders, initiated by common installer/updater executable names.
Detects the execution of files attempting to spoof benign document types via double extensions, specifically when initiated by explorer.exe. This technique is often used in phishing attacks to trick users into executing malicious files that appear to be safe documents.
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Page 89 of 139