Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects a game updater overwriting an established executable in the platform directory with a new binary from a temporary staging path. This behavior can be indicative of a supply chain attack where legitimate game update mechanisms are compromised to deliver malicious payloads.
Detects local development directories where the compromised package matches a fake GitHub user repository URL, specifically looking for 'package.json' file events (creation or modification) within folder paths containing 'maximus-mcmillan'. This is indicative of the Stitch-SDK scope squatting credential harvester technique.
This rule detects files commonly associated with endpoint detection and response (EDR) evasion techniques being staged within 'test' subfolders under a user's 'Documents' directory. The presence of such files (executables, DLLs, PowerShell scripts, or binaries) with names indicating 'loader', 'bypass', 'edr', 'inject', 'payload', 'agent', or 'defender' suggests an attacker is preparing to deploy or test EDR evasion tools on the workstation. This activity could precede a larger attack.
Detects use of macOS resource forks to hide malicious data
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Identifies RuntimeBroker_update.exe sideloading the malicious Rust loader masquerading as UnityPlayer.dll. This detection specifically looks for the loading of 'UnityPlayer.dll' by 'RuntimeBroker_update.exe' in conjunction with the presence of a 'Com.dat' file, indicating the RUSTCLOAK malware's DLL sideloading technique.
Detects Rust-compiled dropper generating its local staging environment inside WebViewFixUtility. This rule specifically looks for file events within the `\AppData\Local\WebViewFixUtility` folder that are initiated by `BrowserViewUtility.exe`.
This rule detects attempts to access or exfiltrate DPAPI (Data Protection API) credentials stored in the 'CREDHIST' folder. Specifically, it looks for file events within the `\Microsoft\Protect\CREDHIST` folder where the initiating process is either `dpapisnoop.exe` or `powershell.exe`. `dpapisnoop.exe` is a known tool for DPAPI credential extraction, and PowerShell can also be used for similar purposes.
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
This rule detects the presence of executables with names commonly associated with legitimate Windows system processes (e.g., system32.exe, winlogon.exe, svchost.exe) but located in non-standard directories outside of 'System32' or 'syswow64'. This behavior is indicative of masquerading, where an attacker attempts to hide malicious executables by naming them after legitimate system processes and placing them in unusual locations to evade detection.
Detects files with suspicious double extensions (e.g., .exe.txt, .dll.txt) or .scr extension, which can indicate an attempt to masquerade malicious executables or scripts as benign text files or screensavers. The rule excludes files in the System32 directory to reduce false positives.
This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.
This rule detects the creation or renaming of files with specific names associated with Deimos ransomware, including '.deimos', '.payment_id', or 'deimos_note'. These file names are commonly used by Deimos ransomware for encrypted files or ransom notes.
Detects NTFS ADS used to hide malicious payloads from standard directory listings
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
Detects files using space after extension to disguise executable files
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
Detects command and control communications via files on removable media
Page 96 of 139