Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects attempts to bypass macOS Gatekeeper security controls by manually removing the 'com.apple.quarantine' extended attribute using 'xattr' or by modifying executable permissions with 'chmod' on specific system or sensitive file paths, such as 'iSync'. These actions are commonly performed to evade execution restrictions on downloaded or untrusted files.
This rule detects potential ransomware activity by correlating the execution of native Windows utilities used to inhibit system recovery (vssadmin, wmic, wbadmin, bcdedit) followed by a high volume of file modification events on the same host within a 15-minute window.
Detects PowerShell processes using the .NET System.IO.File methods (SetLastWriteTime, SetCreationTime, SetLastAccessTime) to modify file timestamps, a common anti-forensic technique to obfuscate file creation or modification times.
Detects PowerShell processes using the .NET System.IO.File methods (SetLastWriteTime, SetCreationTime, SetLastAccessTime) to modify file timestamps, a common anti-forensic technique to obfuscate file creation or modification times.
Detects PowerShell processes using the .NET System.IO.File methods (SetLastWriteTime, SetCreationTime, SetLastAccessTime) to modify file timestamps, a common anti-forensic technique to obfuscate file creation or modification times.
Detects the presence of the malicious 'indexed-btree' npm package, which contains a backdoor that hooks 'BTree.prototype.set' to execute 'sharedLoad.min.js' at runtime. The rule monitors for characteristic file paths, function hooking patterns, and node process spawning behavior designed to evade installation-time static analysis.
Detects instances where node.js or npm processes spawn child processes that subsequently perform write operations into Windows startup folders or registry run keys within a one-hour window. This behavior is indicative of a second-stage payload execution and persistence mechanism often leveraged by threat actors.
Detects a suspicious sequence where the 'chrome_cleanup.exe' binary is written to disk, its Mark of the Web (MOTW) identifier is removed, and it is subsequently launched by an unusual process (e.g., explorer, svchost, dllhost, or rundll32) without command-line arguments. This behavior is indicative of a COM-based shell launch, a technique often used by post-exploitation tools to bypass security controls and execute binaries stealthily.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where the Windows command shell (cmd.exe) creates, modifies, or renames specific suspicious files ('My_Resume.pdf', 'Documents_Details.pdf') within the 'ProgramData' directory, often associated with execution of batch files or file copy operations that may indicate staging of malicious payloads.
Detects the creation of specific file paths and files associated with the PSNATCH file stealer tool, specifically monitoring for the presence of SmartUploader application directories and its associated upload index files. This behavior is indicative of an adversary staging collected data on a local system for subsequent exfiltration.
Detects suspicious file create or write operations within the domain SYSVOL Policies directory. This pattern is commonly associated with attackers attempting to deploy malicious payloads, such as ransom notes or configuration changes, via Group Policy Objects (GPO). The rule monitors Windows Event ID 4663 to identify unauthorized modification attempts by non-system accounts.
Detects browser extension manifest.json files requesting declarativeNetRequest and content_scripts/host_permissions covering AI assistant vendor domains (BragJack attack class)
Detects unauthorized access, modification, or creation of the FileZilla 'sitemanager.xml' configuration file by a process other than the legitimate 'filezilla.exe'. This is a common indicator of an adversary attempting to steal stored FTP credentials or modify connection configurations.
This rule detects suspicious directory creation or file attribute modifications within the 'naverwhale' roaming AppData directory. Adversaries may use this path to stage malicious payloads, persistence mechanisms, or to impersonate legitimate browser files.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects unauthorized processes (non-browser applications) creating, modifying, or renaming sensitive browser data files such as Login Data, Cookies, or local state files within standard browser profile directories. This activity is indicative of credential harvesting or session hijacking attempts by malicious software.
Page 19 of 110