Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects opening of macro-enabled Office documents potentially containing malware
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.
Detects when a single account initiates a high volume of Office file (Word, Excel, PowerPoint) copy or move operations within a one-hour window. This could indicate data exfiltration or staging activities.
This rule detects attempts to access or exfiltrate DPAPI (Data Protection API) credentials stored in the 'CREDHIST' folder. Specifically, it looks for file events within the `\Microsoft\Protect\CREDHIST` folder where the initiating process is either `dpapisnoop.exe` or `powershell.exe`. `dpapisnoop.exe` is a known tool for DPAPI credential extraction, and PowerShell can also be used for similar purposes.
Detects specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files (e.g., mev.png, USO.ico, USO.png) to evade detection.
This rule detects the creation, modification, or renaming of files associated with PCPJack/TeamPCP malware on Linux systems. It specifically looks for these activities in common temporary directories (`/tmp/`, `/dev/shm/`, `/var/tmp/`) and for files with names matching known PCPJack/TeamPCP artifacts (e.g., `pcpcat`, `teampcp`, `xmrig`, `proxy.sh`, `kube.py`, `.pcpx`, `.pcp`) or hidden files (starting with a dot). This activity often indicates the initial staging or persistence mechanisms of the malware.
This rule detects a high volume of access attempts (10 or more within an hour) by a single user to sensitive system directories such as 'Admin' or 'System32'. This behavior could indicate an adversary performing file and directory discovery, attempting to access sensitive files, or staging for further malicious activity.
Identifies .lnk files dropped into Startup folders, a persistence technique tied to WinRAR exploitation.
This YARA rule detects Compiled HTML Help (CHM) files based on specific internal strings related to their structure and compilation. The rule identifies CHM files that contain internal data space and compression references, as well as specific compiler signatures such as "Free Pascal's chm package 3.0.4", "CHMCmd 3.0.4", and "HHA Version 4.74.8702". While the rule's name suggests detection of JavaScript execution via PowerShell within CHM files, the current string-based logic primarily focuses on the file's internal characteristics and compiler metadata, which can be indicative of potentially malicious CHM files used in attack campaigns.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
This rule detects when a file, initially received as an email attachment, is subsequently observed on multiple endpoints within a 7-day period. It correlates SHA256 hashes from email attachment logs with device file events to identify widespread propagation of potentially malicious attachments.
This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.
Detects BITS job configuration files with known persistence mechanisms, such as running at startup
This rule detects activity associated with the GhostLock ransomware by combining three types of signals: file artifact creation/access, specific Python module loads indicative of GhostLock's execution, and the presence of GhostLock-specific command-line arguments. It aims to identify the ransomware across different stages of its operation.
Detects RomulusLoader persistence behavior where Vulkan components (such as vulkan-1.dll or .bin files) are written to the Common Files directory. This activity is associated with TA4922 and their use of RomulusLoader for initial access and staging.
Detects the creation or renaming of files to append the .nspire extension, a direct indicator of NightSpire ransomware encryption activity.
This rule detects the creation or modification of files with specific SHA256 hashes known to be associated with adware. It monitors device file events for these hashes and logs instances where they are created or modified.
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
This rule looks for a non-interactive shell process reading npmrc token files outside normal developer activity. Automated readers often belong to stealers. Rotate npm tokens and check publish history. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects enabling Hide500Users in com.apple.loginwindow plist preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
Page 97 of 139