Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,453
11,838
5,876
5,154
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
Detects when a single account initiates a high volume of Office file (Word, Excel, PowerPoint) copy or move operations within a one-hour window. This could indicate data exfiltration or staging activities.
Detects creation of AI coding assistant configuration files used by the Miasma worm
for persistence. The malware injects setup scripts into .claude, .cursor, .gemini,
and .vscode directories that execute via Bun on IDE open.
for persistence. The malware injects setup scripts into .claude, .cursor, .gemini,
and .vscode directories that execute via Bun on IDE open.
This rule detects indicators of compromise (IOCs) associated with the Red Lamassu (JFMBackdoor) campaign. It identifies malicious file hashes, network communication with known command and control (C2) domains and IP addresses, specific file paths and names used by the malware, and registry modifications for persistence. The rule looks for file events, process creations, network connections, and registry changes that match the defined IOCs.
This rule detects suspicious file system enumeration activities that often precede ransomware encryption. It specifically looks for a high volume of command-line executions of 'dir /s', 'dir /r', or 'tree' commands within a short timeframe (5 minutes) on a single computer by a single account. These commands are commonly used by adversaries to discover files and directories before encrypting them.
Detects the initiation of a FileSystemWatcher object in PowerShell configured to monitor the 'Changed' event. This technique is used by GammaSteel for real-time document surveillance to steal files the moment they are modified.
Detects enabling Hide500Users in com.apple.loginwindow preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
Detects the creation of the java_app.lock file in the Windows temporary directory, which serves as a single-instance lock file for the Nimbus RAT.
Detects the creation of the specific sentinel file '.bun_ran' generated by the Hades Python loader to avoid repeated executions.
Detects the creation of the specific sentinel file '.bun_ran' generated by the Hades Python loader to avoid repeated executions.
Detects file write operations to '/mnt/runner' indicating a sudoers configuration modification. This technique is utilized by the Miasma npm malware to grant passwordless sudo access for privilege escalation on GitHub Actions CI/CD runners.
Detects the creation of Vulkan components (e.g., vulkan-1.dll, .bin files) within the C:\Program Files\Common Files\ directory. This behavior is associated with TA4922 leveraging RomulusLoader for persistence via DLL sideloading.
Detects creation or manipulation of the ROTATE subdirectory within the Skylight Metrics Agent path by non-SYSTEM accounts. CVE-2026-7791 exploitation requires replacing the legitimate ROTATE directory with a junction point targeting the attacker's desired write location. The Skylight service then follows the junction during its log rotation, writing attacker-controlled files to the target with SYSTEM privileges. Any non-SYSTEM interaction with this specific path warrants investigation.
Auto-Color is a Linux backdoor that installs a malicious library libcext.so.2 and writes it to /etc/ld.preload so the library loads before all other executables. This allows the malware to hook libc functions and hide its C2 connections. This rule looks for modifications to ld.preload or the presence of libcext.so.2 in the library path. In plain terms, it catches when a backdoor is trying to make itself invisible by loading first and controlling what the system reports.
This rule detects potential ransomware activity by identifying a high volume of file encryption events. It looks for files being renamed or created with common ransomware-related extensions such as '.locked', '.crypt', '.encrypted', '.enc', or a generic pattern of a 6 or more character alphanumeric extension. The rule then counts these events within one-hour bins and alerts if more than 20 such files are detected in a single folder path.
Identifies .lnk files dropped into Startup folders, a persistence technique tied to WinRAR exploitation.
This rule detects suspicious file system enumeration activities that often precede ransomware encryption. It specifically looks for a high volume of command-line executions of 'dir /s', 'dir /r', or 'tree' commands within a short timeframe (5 minutes) on a single computer by a single account. These commands are commonly used by adversaries to discover files and directories before encrypting them.
Detects the creation of the specific hardcoded temporary file (~wra1269.tmp) used by the Argamal RAT to store captured screenshots during its surveillance operations prior to exfiltration.
Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.
Detects the creation of specific payload staging files (filter.bin, kernel-diag.lib) in the anomalous ApplicationData32 directory, a behavior indicative of UAC-0184 staging prior to decoding and execution.
This query identifies devices and users where the compromised Nx Console VS Code extension version 18.95.0 was observed in the local VS Code extensions directory or referenced in process command-line activity. The detection focuses only on the affected version: nrwl.angular-console-18.95.0. This query combines two evidence sources: DeviceFileEvents (confirms file or folder activity related to the extension path) and DeviceProcessEvents (confirms execution or command-line reference involving the extension).
Page 98 of 139