Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects browser extension manifest.json files requesting declarativeNetRequest and content_scripts/host_permissions covering AI assistant vendor domains (BragJack attack class)
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
This rule detects unauthorized processes modifying the 'Secure Preferences' configuration file in Google Chrome or Microsoft Edge browser data directories. This activity often indicates an attempt by malicious software to hijack browser settings, such as forcing extensions or modifying security policies, which is a common precursor to credential theft or persistent malicious access.
This rule detects unauthorized processes modifying the 'Secure Preferences' configuration file in Google Chrome or Microsoft Edge browser data directories. This activity often indicates an attempt by malicious software to hijack browser settings, such as forcing extensions or modifying security policies, which is a common precursor to credential theft or persistent malicious access.
This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.
Detects potential web shell or malicious DLL deployment into Microsoft Exchange or IIS directories by the IIS worker process (w3wp.exe), as well as suspicious child process execution (such as command-line shells or credential discovery tools) spawned directly from IIS worker processes.
Detects unauthorized attempts to modify WordPress user tables (wp_usermeta) by web server processes to escalate privileges, specifically targeting the 'wp_capabilities' or 'administrator' flags. This activity is indicative of an exploit or post-exploitation behavior following a web-based attack.
This rule detects potential web shell activity within the 'Admin Menu Editor Pro' WordPress plugin. It searches for PHP files containing a combination of sensitive execution functions (e.g., eval, base64_decode, system) which are characteristic of the malicious code injected into versions 2.35/2.36 of the plugin during its supply chain compromise.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects the creation of multiple or specific file locks that deviate from standard naming conventions, often associated with wiper malware attempting to overwrite files or fill disks by creating locking files as part of their destructive payload.
This rule detects a sequence of suspicious activities involving files placed in 'ProgramData\Firefox'. It identifies the creation or modification of a non-standard executable within this folder, followed by its execution by a trusted process (or itself), and the subsequent creation of a Registry run key for persistence. This pattern is often used by adversaries for persistence mechanism implementation using masqueraded file names.
This rule detects the creation or modification of a file named 'ClipBoard.txt' within the directory 'AppData\Roaming\ConfigsEx\', as well as the creation of the 'ConfigsEx' directory using command-line tools. This behavior is indicative of an adversary staging sensitive information, such as harvested clipboard data, for potential exfiltration.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects a process loading known malicious DLLs (winfsp-x64.dll or DukeQt.dll) used by the FamousSparrow threat actor, followed by the creation or modification of a .dat file in the same process context. This pattern is indicative of the reflective loading of a backdoor payload without leaving the secondary binary on disk.
Detects a process loading known malicious DLLs (winfsp-x64.dll or DukeQt.dll) used by the FamousSparrow threat actor, followed by the creation or modification of a .dat file in the same process context. This pattern is indicative of the reflective loading of a backdoor payload without leaving the secondary binary on disk.
Detects instances where common Windows web server processes (w3wp.exe or UMWorkerProcess.exe) initiate suspicious child processes (cmd.exe, powershell.exe, etc.) within a short duration of a file modification event involving known potentially malicious DLL files (winfsp-x64.dll or DukeQt.dll), characteristic of web shell exploitation or post-compromise activity on Exchange/IIS servers.
Detects a process loading known malicious DLLs (winfsp-x64.dll or DukeQt.dll) used by the FamousSparrow threat actor, followed by the creation or modification of a .dat file in the same process context. This pattern is indicative of the reflective loading of a backdoor payload without leaving the secondary binary on disk.
Page 26 of 110