Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects archive utilities extracting an LNK (shortcut) file directly to disk, specifically in Downloads or Temp folders, which is a common initial access vector preceding script execution.
This rule detects processes accessing or loading specific files (such as .mui, .dat, .nls, and .etl files) that are associated with specific naming conventions (xwreg, xgdf) or locations often targeted by malicious DLL search order hijacking or masquerading attempts. By identifying files that mimic or occupy paths related to system resources, the rule aims to uncover activity indicative of persistence or evasion techniques.
This rule detects modifications to Windows Registry Run keys that point to suspicious directories associated with the SharkLoader malware (such as 'xwreg' or 'xgdf' subdirectories in AppData) or an abnormally located SystemSettings.exe executable, both of which are common indicators of persistence attempts.
Detects anomalous file activity and process execution associated with the SharkLoader malware family. The rule looks for the loading of specific component files (DscCoreR.mui, SyncRes.dat, SystemSettings.dll) from suspicious directories, as well as the execution of SystemSettings.exe from non-standard AppData or ProgramData paths, which indicates a beacon injection or execution chain.
This rule detects potential malicious activity by tracking the aggregation of multiple distinct persistence mechanisms on a single host. It triggers when a single process is associated with at least four unique types of persistence-related events, such as scheduled task registration, startup folder file creation, registry run key updates, Winlogon configuration changes, IFEO modifications, or service registration.
Detects the creation of files with a '.vile' extension within the Google Chrome extensions directory. This path is commonly used for installing extensions, and files with unconventional or obfuscated extensions in this directory may indicate the installation of malicious or unauthorized browser extensions.
Detects suspicious combinations of API calls and system monitoring often used by the VILE ransomware family to evade debuggers, sandboxes, and automated analysis environments. This includes detecting the registration of Vectored Exception Handlers (VEH), memory checks for debugging artifacts, reading the Process Environment Block (PEB), and monitoring for file restoration activities via ReadDirectoryChangesW.
Detects the Pay2Key ransomware's reconnaissance behavior of probing the Avast Software installation directory using a 7-Zip self-extracting executable as a precursor to performing DLL sideloading of a malicious powrprof.dll file.
Detects activity associated with VILE ransomware where files within the Google Chrome extensions directory are renamed with the .vile extension, indicating an ongoing file encryption process by the malware.
Detects LCRYX ransomware establishing persistence by modifying the Winlogon Shell registry key and creating multiple VBScript-based entries in Windows Run keys. The rule monitors for registry modifications targeting known persistence locations with suspicious scripts as values.
Detects the BadBlocker Adblock for YouTube extension (cmedhionkhpnakcndndgjdbohmhepckk) leveraging chrome.scripting.executeScript to inject server-fetched JavaScript into the MAIN world of web pages, specifically utilizing the 'trusted-create-element' scriptlet to facilitate this behavior.
Detects Chrome extension package files associated with the 'BadBlocker' Adblock for YouTube campaign, identifying malicious indicators such as specific remote fetch logic ('scripletsRules'), Unistream SDK integration, and execution patterns that abuse browser extension functionality to bypass security controls or fetch remote content.
This rule detects the use of 'chmod' or 'chown' commands on critical system directories ('/etc', '/bin', '/usr', '/sbin') on Cisco vManage, vSmart, and vEdge networking appliances. Such activity could indicate unauthorized modification of system files, persistence attempts, or privilege escalation by an adversary targeting the networking infrastructure.
Detects the installation of known-malicious browser extensions followed by network communication from the browser process to associated Command and Control (C2) domains within a one-hour window. This behavior is indicative of malicious browser-based activity such as ad-fraud or credential theft.
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
Detects the creation or referencing of 'lopa.txt' which the Seedworm threat group uses to save stolen passwords. This rule identifies processes that interact with 'lopa.txt' either through their command line arguments or by directly accessing a file with that name.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
Detects file events related to potential Remcos RAT loader activity, specifically looking for files with names starting with 'GST' or containing 'GST_' and within a specific size range (1KB to 1000KB). This pattern is indicative of a known Remcos RAT loader.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
Identifies Storm-1175 abusing legitimate enterprise software deployment tools like PDQ Deploy to push the Medusa encryptor to all domain endpoints simultaneously. The rule correlates process events related to PDQ Deploy with file events indicating the creation of files with a '.medusa' extension, which is characteristic of the Medusa ransomware.
Identifies network connections made by Python immediately after loading safetensors or pickle files, indicating a potential supply chain payload phoning home. The rule joins file events where specific model file types (.safetensors, .pkl, .pth) are loaded with network connection events from the same initiating process within one minute of the file load. It specifically excludes local loopback connections.
Page 92 of 139