Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects modifications to the Windows hosts file by unauthorized processes. The hosts file is often targeted by adversaries to redirect network traffic, intercept communications, or prevent access to security-related websites.
Detects unauthorized write, create, or rename operations on the Windows HOSTS file (\drivers\etc\hosts). The rule excludes common system processes and paths associated with legitimate administrative or update activities, targeting potentially malicious attempts to redirect network traffic by modifying DNS resolution locally.
This rule detects the creation, modification, or renaming of files that contain sensitive keywords (e.g., 'password', 'seed', 'wallet', 'recovery') by processes other than standard system or productivity applications. This activity is indicative of credential or sensitive data harvesting.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects processes accessing or modifying Microsoft Outlook data files (.pst or .ost), which may indicate an attempt to collect, stage, or export sensitive email data from a local system.
Detects the SMB share discovery pattern associated with the DragonForce ransomware, where the system enumerates network shares (excluding ADMIN$) followed by unauthorized bulk write operations to these shares, indicating potential lateral movement and file encryption.
Detects the installation or update of browser extensions that possess both 'declarativeNetRequest' and 'content_scripts' permissions, while also requesting host permissions for major AI assistant or trusted vendor domains (e.g., google.com, gemini.google.com, copilot.microsoft.com, claude.ai). This specific combination of permissions is characteristic of the BragJack attack chain used to redirect network traffic and hijack AI browser agent sessions.
Detects access, reading, or modification of sensitive credential files (such as KeePass databases, VPN profiles, private SSH keys, and certificates) by a process. This behavior is often associated with pre-encryption staging for data exfiltration during ransomware attacks.
Detects the creation, renaming, or modification of a file named 'FitnessMonitor.exe' within the Windows Startup folder. This behavior is indicative of an attempt to establish persistence by ensuring the executable runs automatically upon user login.
Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.
Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.
Page 21 of 110