Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects unique INFINITERED marker strings in process command lines or event metadata. The indicators include the upgrade-code GUID delimiter, its Base64 representation, the stolen-session identifier prefix, and the custom file-download command tag. These values are specific to the reported malware and should be treated as high-confidence evidence when present.
Detects opening of macro-enabled Office documents potentially containing malware
Detects the sideloading of 'msvcp140.dll' or 'mscoree.dll' when loaded from a 'ProgramData' directory that does not contain 'Microsoft' in its path. This pattern is indicative of an adversary attempting to execute malicious code by placing a malicious DLL in a location where a legitimate application will load it, bypassing standard security controls.
Detects the creation of large archive files (zip, rar, 7z, tar.gz) exceeding 50MB in common temporary or program data folders, specifically when these archives are created shortly after files from user document directories (Documents, Desktop, Downloads, Finance, HR, Accounting) were copied or read. This behavior is indicative of data staging by the MedusaLocker ransomware variant prior to encryption or exfiltration.
Detects the creation or modification of a local VSCode workspace extension (package.json) that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting 'skipPublisherTrust' to true. This technique is used to bypass VSCode's publisher trust mechanisms and silently install malicious extensions.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
This rule detects the presence of executables with names commonly associated with legitimate Windows system processes (e.g., system32.exe, winlogon.exe, svchost.exe) but located in non-standard directories outside of 'System32' or 'syswow64'. This behavior is indicative of masquerading, where an attacker attempts to hide malicious executables by naming them after legitimate system processes and placing them in unusual locations to evade detection.
This rule detects potential DLL sideloading activity by monitoring process creation events where specific executables ("Setup_File_75.593.2113.exe" or "SystemSettings.exe") are launched with a command line containing "borlndmm.dll". It then correlates this with file events to confirm the presence of "borlndmm.dll" on the same device. This pattern is indicative of the OnyxC2 malware attempting to load a malicious DLL.
This rule detects misconfigurations in GitHub Actions workflows related to Claude automation. Specifically, it looks for workflow files (.yml or .yaml) within the '.github/workflows' directory where the initiating process command line contains 'allowed_non_write_users' or 'claude-code-action' along with a wildcard ('*') in the user permissions. Such a configuration could allow unauthorized users to trigger code changes via AI actions on a repository, indicating a potential security vulnerability.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Detects execution or file activity involving SHA-256 hashes attributed to analyzed VVS Discord Stealer samples. This rule provides high-confidence indicator coverage and should be retained as supporting intelligence alongside the behavioral detections in this pack.
This rule detects suspicious JavaScript or HTML files that attempt to cloak browser fingerprints by manipulating WebGL renderer information, timezone settings, touch support, and tampering with the browser console or developer tools. It specifically looks for the co-occurrence of keywords related to these techniques within file names or the effective username associated with the file event.
This rule detects the creation or modification of files with specific SHA256 hashes known to be associated with adware. It monitors device file events for these hashes and logs instances where they are created or modified.
This rule detects the creation or renaming of files with specific names associated with Deimos ransomware, including '.deimos', '.payment_id', or 'deimos_note'. These file names are commonly used by Deimos ransomware for encrypted files or ransom notes.
This rule detects potential exploitation attempts targeting REDCap, specifically looking for file events involving 'help.php' or 'Upgrade.php', or network events where the remote URL contains 'REDCAP-TOKEN'. These indicators suggest an attacker might be trying to exploit known vulnerabilities or exfiltrate data from a REDCap instance.
Identifies the presence of the known ITScape (CVE-2026-46316) proof-of-concept executable by its SHA256 hash. This vulnerability enables a critical guest-to-host escape affecting ARM64 infrastructure.
Detects command and control communications via files on removable media
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.
Detects file events related to potential Remcos RAT loader activity, specifically looking for files with names starting with 'GST' or containing 'GST_' and within a specific size range (1KB to 1000KB). This pattern is indicative of a known Remcos RAT loader.
Page 95 of 139