Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects a malicious persistence mechanism where a suspicious process ('chost.exe') is registered in the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key to execute at startup. The rule specifically monitors for registry keys pointing to temporary directories or unconventional path structures often associated with this RAT, while correlating this with the execution of the process from a non-system directory (i.e., outside System32/SysWOW64).
This rule detects the execution of QEMU-related binaries (qemu-system-x86_64.exe, qemu-img.exe) and subsequent file operations involving specific virtual machine disk image extensions (.qcow2) and database files (.db) located outside of standard application directories. This activity may indicate the unauthorized deployment of a virtual machine or the use of QEMU for staging or hiding data on the host.
This rule detects potential DLL sideloading by identifying signed executables that load unsigned DLLs from user-writable directories, such as Temp, AppData, Downloads, or Documents. It excludes loads from standard, protected Windows directories to reduce noise.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
Detects activity associated with the macOS.Gaslight credential stealer, specifically focusing on Python processes accessing the login.keychain-db, browser credential stores, creating a 'collected_data.zip' archive, and executing security or reconnaissance commands. This rule identifies file events (creation, modification, read, copy) related to keychain and archive staging, as well as process events involving the 'security' command for password extraction and 'ps' or 'system_profiler' for system reconnaissance, all initiated by Python.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
Detects the execution or file events related to 'ugate.exe' when it is located in the 'C:\Users\Public\Documents\' folder or its subfolders. This location is often used by malware for persistence or staging.
This rule detects potential AI-obfuscated phishing attempts by correlating the launch of a local HTML file (likely from an email attachment or download) with immediate network connections to highly randomized or AI-generated subdomains. These subdomains are often used to host Adversary-in-The-Middle (AiTM) proxies or credential POST endpoints in sophisticated phishing campaigns.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
Detects instances where non-browser processes access sensitive browser-related files (Login Data, Cookies, or Local State) located within AppData directories. This behavior is highly indicative of credential and session token theft, often associated with AiTM or post-compromise information harvesting activities.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
Detects instances where a process not associated with a known web browser attempts to read sensitive browser credential stores (such as Chrome Login Data, Edge Login Data, or Firefox key4.db/logins.json). This behavior is characteristic of infostealers attempting to extract saved browser credentials.
Detects instances where a signed process loads a dynamic-link library (DLL) from a user-writable directory, such as Temp, AppData, Downloads, or Public. This behavior is a common technique used for DLL sideloading to hijack the execution flow of trusted, signed applications.
Detects the creation of common ransomware note file names with suspicious extensions.
This rule detects potential container escape attempts on Linux systems by monitoring suspicious file system access patterns to the host's root directory or process creation events involving 'mount', 'nsenter', or 'chroot' commands with parameters indicative of host interaction. Specifically, it looks for file operations on '/proc/1/root', '/proc/1/cwd', '/proc/1/exe', '/proc/1/fd', '/proc/1/ns', '/proc/1/environ', '/proc/1/mounts' or paths starting with '/host', '/hostroot', '/host-root', '/node-root'. It also flags 'mount' commands targeting '/proc/1/root', '/proc/1', 'nsenter', '--target 1', 'hostpath', or '/host', 'nsenter' commands with namespace manipulation arguments, and 'chroot' commands targeting '/proc/1/root', '/host', or '/hostroot'. These activities are commonly associated with adversaries trying to break out of a containerized environment to gain access to the underlying host.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or collection, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.
This rule detects potential DLL sideloading activity by monitoring process creation events where specific executables ("Setup_File_75.593.2113.exe" or "SystemSettings.exe") are launched with a command line containing "borlndmm.dll". It then correlates this with file events to confirm the presence of "borlndmm.dll" on the same device. This pattern is indicative of the OnyxC2 malware attempting to load a malicious DLL.
Page 93 of 139