Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,445
11,833
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects Attack Surface Reduction (ASR) block events where a file operation was prevented. It specifically filters out audit-only events and excludes operations on .dll and .tmp files to reduce noise. The rule aims to identify malicious activity that ASR has actively blocked, indicating a potential attempt to execute or modify files in a suspicious manner.
This rule detects when a file, initially received as an email attachment, is subsequently observed on multiple endpoints within a 7-day period. It correlates SHA256 hashes from email attachment logs with device file events to identify widespread propagation of potentially malicious attachments.
This rule detects potential ransomware activity by identifying a high volume of file encryption events. It looks for files being renamed or created with common ransomware-related extensions such as '.locked', '.crypt', '.encrypted', '.enc', or a generic pattern of a 6 or more character alphanumeric extension. The rule then counts these events within one-hour bins and alerts if more than 20 such files are detected in a single folder path.
Detects the creation of 'configA.json' by a Python process, which indicates successful host profiling by KongTuke's ModeloRAT reconnaissance module. This file is typically dropped after the reconnaissance phase to store collected system information.
Detects the creation of an unexpected LaunchAgent property list named 'com.google.keystone.agent.plist' paired with the creation or execution of a binary at '~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate'. This exact path and plist combination is used by the SHub Reaper malware to establish persistent backdoor access while masquerading as a Google software update.
Detects the creation of the specific named pipe 'GreenPlasmaSystemPipe' used for SYSTEM token impersonation. This is an explicit Indicator of Compromise (IOC) from the default GreenPlasma payload.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects the creation or presence of specific artifact files (.ghostlock_authorized and ghostlock_cache.json) associated with the GhostLock proof-of-concept availability weapon. These files are used by the tool to manually authorize locking operations in specific directories and to cache discovered file lists for rapid session re-establishment.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects file creation events associated with the Mini Shai-Hulud npm/PyPI supply-chain attack campaign targeting TanStack, Mistral AI, OpenSearch, and Guardrails AI packages.
Detects potential user namespace manipulation, a common precursor to kernel namespace exploits like Dirty Frag, by monitoring file modifications to uid_map and gid_map.
Detects exclusive SMB file handle requests (ShareAccess = 0), which are utilized by the GhostLock denial-of-service technique.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
Detects write operations or modifications to 'uid_map', 'gid_map', or 'setgroups' files within the /proc directory.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.
This is a KQL detection based on the YARA rules by Jason Baker of GuidePoint Security in linked reference - Connected to the Akira ransomware exploits
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
(CVE-2026-26117)
(CVE-2026-26117)
Detects the creation of 'format-results.txt' on a system, which is used by the malicious GitHub Actions workflow injected by the Checkmarx worm to store serialized GitHub repository secrets.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Page 99 of 139