Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. This can be used by adversaries for persistence, privilege escalation, or defense evasion.
Detects unexpected file modifications by 'dns.exe', which could indicate remote code execution or other exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out modifications to 'dns.log' to reduce false positives.
Detects unusual processes accessing 'desktop.ini' remotely over a network share with write permissions. This activity can be leveraged to alter how Windows Explorer displays a folder's content (e.g., renaming files) without actually changing the files on disk, which can be used for persistence or privilege escalation.
Detects when an uncommon process modifies the Windows Terminal profile settings file, "settings.json". This activity can be indicative of persistence or privilege escalation attempts where an attacker modifies the terminal's startup behavior or injects malicious commands to be executed when the terminal is launched.
This rule identifies modifications to the `/etc/ld.so.preload` file. This file is used by the Linux dynamic linker to specify shared libraries that should be loaded before any other libraries. Attackers can modify this file to inject malicious shared objects into processes, enabling privilege escalation, persistence, or defense evasion by loading arbitrary code.
KQL Query
This rule detects the creation or modification of the `/etc/ld.so.preload` file. This file is used by the dynamic linker (`ld.so`) on Linux systems to specify shared libraries that should be loaded before any other libraries. Adversaries can leverage this mechanism for persistence, privilege escalation, or defense evasion by preloading malicious libraries, effectively hijacking legitimate functions. Refer to `man ld.so` for more details on its functionality.
Detects the modification of common WordPress PHP files to include content characteristic of the UNC5142 CLEARSHORT infection chain. This activity is indicative of a compromised web server. This rule requires a File Integrity Monitoring (FIM) solution or EDR that can inspect the contents of modified files.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.
The analytic detects file writes with extensions indicative of a SamSam ransomware attack. It leverages file-system activity data to identify file names ending in .stubbin, .berkshire, .satoshi, .sophos, or .keyxml. This activity is significant because SamSam ransomware is highly destructive, leading to file encryption and ransom demands. If confirmed malicious, the impact includes significant financial losses, operational disruptions, and reputational damage. Immediate actions should include isolating affected systems, restoring files from backups, and investigating the attack source to prevent further incidents.
The analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns. This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption. If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
The following analytic detects the creation of Alternate Data Streams (ADS) with Base64 content on Windows systems. It leverages Sysmon EventID 15, which captures file creation events, including the content of named streams. ADS can conceal malicious payloads, making them significant for SOC monitoring. This detection identifies hidden streams that may contain executables, scripts, or configuration data, often used by malware to evade detection. If confirmed malicious, this activity could allow attackers to hide and execute payloads, persist in the environment, or access sensitive information without being easily detected.
Modifying Crontab
Sigma
Detects suspicious modification of crontab file.
Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Detect attempt to enable auditing of TTY input
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Detects probable exploitation of the reported Notepad++ plugin DLL hijack by correlating DLL loads from Notepad++\plugins with recent file changes or swap-style renames, prioritising user-writable locations (Users/AppData/OneDrive) and weak trust. Outputs a Verdict and SuspicionScore for quick triage.
Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
Detects when a command-line interpreter (cmd.exe or powershell.exe) writes or modifies a file within a SharePoint \TEMPLATE\LAYOUTS directory. This activity is suspicious as it could indicate an attempt to deploy a web shell or other malicious code to gain persistent access or execute commands on the SharePoint server. The rule specifically excludes a known legitimate SharePoint automation script to reduce false positives.
Page 104 of 110