Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the creation, modification, or renaming of files named '.passphrase' or '.txid' within user directories. These file names are indicative of potential sensitive credential or wallet-related data storage, which may be targeted by adversaries for credential theft or unauthorized access.
Detects the creation, modification, or renaming of plist files within macOS LaunchAgent directories that match a specific naming pattern (com.[16 letters].plist). This pattern is often used by malware or unauthorized scripts to establish persistence. The rule excludes common, legitimate system processes like Installer and softwareupdated.
Detects a sequence of actions often used to bypass macOS Gatekeeper protections: removing the quarantine extended attribute using 'xattr -c' on a file in the /tmp directory, followed by making that file executable with 'chmod +x', and finally executing the file. This behavior is indicative of malicious software attempting to evade Apple's security checks for downloaded files.
Detects a sequence of actions often used to bypass macOS Gatekeeper protections: removing the quarantine extended attribute using 'xattr -c' on a file in the /tmp directory, followed by making that file executable with 'chmod +x', and finally executing the file. This behavior is indicative of malicious software attempting to evade Apple's security checks for downloaded files.
Detects a sequence of actions often used to bypass macOS Gatekeeper protections: removing the quarantine extended attribute using 'xattr -c' on a file in the /tmp directory, followed by making that file executable with 'chmod +x', and finally executing the file. This behavior is indicative of malicious software attempting to evade Apple's security checks for downloaded files.
Detects the creation of Object Manager symbolic links that redirect the Windows Defender 'WD_SCAN' object to a loopback UNC share path. This behavior is indicative of a symlink exploitation technique (ShieldCrash/CVE-2026-69414) used to manipulate Windows Defender or associated scan operations by redirecting them to an adversary-controlled or loopback-hosted target.
Detects suspicious file create or write operations within the domain SYSVOL Policies directory. This pattern is commonly associated with attackers attempting to deploy malicious payloads, such as ransom notes or configuration changes, via Group Policy Objects (GPO). The rule monitors Windows Event ID 4663 to identify unauthorized modification attempts by non-system accounts.
Detects the creation or modification of scheduled tasks (cron jobs) located within web application log directories (e.g., JBoss, Tomcat, Wildfly) that exhibit behavior consistent with malicious file reinjection. This rule correlates suspicious cron activity with recurring modifications to sensitive web files (e.g., JS bundles, checkout pages), indicating persistent skimmer activity that survives redeployment.
The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories.
It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*".
This activity is significant as it may indicate data exfiltration or unauthorized access to email data.
If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network.
It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*".
This activity is significant as it may indicate data exfiltration or unauthorized access to email data.
If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network.
This rule detects potentially malicious behavior involving the Python interpreter spawning command-line shells (cmd.exe or powershell.exe), or interactions (creation/modification) with a specific file at 'C:\ProgramData\ur.txt'. This behavior is often associated with post-exploitation activities, staging, or script-based execution of malicious payloads.
Detects the abuse of the legitimate Windows utility 'certutil.exe' to download files from external sources or to decode/deobfuscate files on the host, commonly used as a LOLBIN for malicious activities.
Detects file creation, modification, or renaming activity within AppData directories associated with VPN clients (CyberGhost, NordVPN, ExpressVPN). This rule is intended to identify potential unauthorized access, staging, or tampering with VPN configuration files or credentials often stored in these application directories.
Detects modifications, creation, or renaming of common cryptocurrency wallet files (e.g., wallet.dat, .wallet files) within known storage directories. This behavior is often associated with infostealers or malware attempting to exfiltrate or manipulate user financial assets.
This rule detects potential information stealer activity by identifying the staging of files (.html, .txt, .log) in common user directories like AppData or Temp, combined with process command lines querying sensitive system information (e.g., BIOS, wallets, screen resolution) and network connections to the Telegram API for likely exfiltration.
Detects attempts to bypass macOS Gatekeeper security controls by either removing the quarantine extended attribute or marking a file as executable using 'xattr' or 'chmod'. These techniques are used to allow untrusted or malicious applications to execute without user authorization.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects high volumes of file creations, modifications, or renames ending with a specific encrypted file extension (.df_win) occurring across multiple network (SMB) shares from a single host within a short timeframe. This behavior is indicative of ransomware activity where a compromised host attempts to encrypt files on accessible remote storage.
Detects potential abuse of rundll32.exe to execute commands or functions, particularly those involving references to 'WindowsUpdate.log' or direct execution with ordinal identifiers ('#1'). This rule also monitors file operations involving 'WindowsUpdate.log' initiated by common script interpreters like powershell.exe, cmd.exe, or rundll32.exe, which is often associated with obfuscated techniques to execute malicious payloads or bypass security controls.
Detects malicious PHP web shell patterns (e.g., base64_decode, system, eval, passthru) within the WordPress plugins directory. This often indicates the presence of a trojanized plugin update or unauthorized file modification following a supply chain compromise.
Detects obfuscated PHP code within the Admin Menu Editor Pro plugin, specifically targeting indicators associated with the supply chain compromise of versions 2.35 and 2.36. The rule searches for common PHP execution functions used in web shells within the context of the vulnerable plugin directory.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Page 23 of 110