Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects the presence of files on endpoints that match a list of known malicious SHA256 hashes associated with the Nuso malware. It queries DeviceFileEvents to identify any file with a matching hash.
This rule detects the presence of files or processes with known malicious SHA256 or MD5 hashes. It queries both DeviceProcessEvents and DeviceFileEvents to identify if any file or running process matches the provided list of malicious hashes.
Detects the execution of Microsoft Edge via the command shell to open a PDF file. This pattern can be indicative of malicious activity where an attacker attempts to bypass direct execution or leverage a browser vulnerability to open a malicious PDF.
This rule detects the presence of known ShadowAgent malware files on devices by matching their SHA256 hashes. It queries 'DeviceFileEvents' to identify any files with SHA256 hashes that are part of a predefined list associated with ShadowAgent.
Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.
Detects anomalous process execution and filesystem access patterns originating from Gitea Act Runner that indicate an attempted container-to-host escape. This includes the injection of dangerous container flags (e.g., --pid=host, --privileged, --cap-add=ALL) into workflow commands, the execution of nsenter, or direct access to the host's filesystem structures (e.g., /host or /proc/1/root).
Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.
This rule detects the presence or installation of a specific malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). This extension masquerades as a 'Search for perplexity ai' utility but is designed to hijack browser search queries by redirecting them to a typosquatted domain ('perplexity-ai.online') using declarativeNetRequest rules.
Detects the installation of a malicious browser extension that impersonates the legitimate Perplexity AI service. The extension leverages a typosquatted domain ('perplexity-ai.online') and a specific extension ID to facilitate search hijacking and keystroke collection on the victim host.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Detects the execution of 'PerfWatson2.exe' when initiated from the user-writable 'AppData\Local' directory. 'PerfWatson2.exe' is a legitimate Windows process associated with the Windows Error Reporting service; its presence or execution from a user directory is indicative of masquerading or potential malware activity.
Detects the execution of 'PerfWatson2.exe' when initiated from the user-writable 'AppData\Local' directory. 'PerfWatson2.exe' is a legitimate Windows process associated with the Windows Error Reporting service; its presence or execution from a user directory is indicative of masquerading or potential malware activity.
Detects execution activity associated with the Grandoreiro banking trojan, specifically identifying DLL side-loading of known malicious files (e.g., mingwm10.dll, libwebp.dll) from user-writable AppData directories, and the execution of unsigned binaries spawned by script interpreters like wscript.exe, cscript.exe, or mshta.exe.
Detects DLL side-loading activity associated with the Grandoreiro banking trojan. The rule identifies instances where legitimate, signed software (e.g., FastStone Image Viewer, MinGW, FreeMat, AbiWord) loads known malicious DLLs (e.g., mingwm10.dll, libwebp.dll) from user-writable directories such as %TEMP% or %APPDATA%, which is a characteristic behavior of the malware.
Detects the creation or modification of shortcut (.lnk) files within the Windows Startup folder by known archive utilities (e.g., WinRAR, 7-Zip). This behavior is highly suspicious as these tools are commonly leveraged by adversaries to drop malicious payloads or persistence mechanisms into the user's startup directory.
This rule monitors file creation events for RAR archives containing specific keywords in the filename related to military, intelligence, or drone-related topics in Ukrainian. It also flags specific file hashes associated with malicious activity. The rule is designed to detect the delivery or presence of targeted spearphishing attachments or documents used for information gathering or exploitation.
Detects files retaining the MOTW (Zone.Identifier) executing successfully because their Fox Tempest signature bypasses SmartScreen warnings.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Detects host-based activity related to known UAC-0226 campaign artifacts, including specific decoy PDF filenames and malicious LNK file names found in command-line arguments or file system events (FileName, TargetFilename).
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Page 90 of 139