Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
Detects modifications to the /etc/sudoers or /etc/sudoers.d configuration files by non-root users. This activity is often associated with privilege escalation attempts where an adversary attempts to modify sudo policies to grant themselves elevated permissions or bypass password requirements.
Detects modifications to the /etc/sudoers or /etc/sudoers.d configuration files by non-root users. This activity is often associated with privilege escalation attempts where an adversary attempts to modify sudo policies to grant themselves elevated permissions or bypass password requirements.
Detects modifications to the /etc/sudoers or /etc/sudoers.d configuration files by non-root users. This activity is often associated with privilege escalation attempts where an adversary attempts to modify sudo policies to grant themselves elevated permissions or bypass password requirements.
Detects unauthorized modifications, creations, or renames of Pluggable Authentication Module (PAM) configuration files or core shared libraries (such as pam_rootok.so or pam_permit.so) by non-root users. Attackers often modify these files to bypass authentication mechanisms and achieve privilege escalation. The rule excludes common package management tools to minimize false positives.
Detects unauthorized modifications, creations, or renames of Pluggable Authentication Module (PAM) configuration files or core shared libraries (such as pam_rootok.so or pam_permit.so) by non-root users. Attackers often modify these files to bypass authentication mechanisms and achieve privilege escalation. The rule excludes common package management tools to minimize false positives.
This rule detects file creation or modification events within the WordPress plugin directory for 'admin-menu-editor-pro'. Given that WordPress plugins are frequent targets for web shell placement, this rule monitors for unauthorized changes to the plugin's file structure, which may indicate an attempt to gain persistence or remote code execution on the web server.
Detects file-related operations (creation, modification, renaming, or deletion) performed on files containing 'acronis' or 'backup' in their path, executed by a process associated with Acronis, running under highly privileged system contexts (root or SYSTEM). This activity is indicative of potential unauthorized manipulation or disabling of backup software, commonly seen in ransomware attacks to inhibit recovery.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects unauthorized modification of file permissions on Acronis-related files or directories, or modification of Acronis-related files by non-authorized users. This rule targets attempts to weaken file security (e.g., setting permissions to 777 or 666) or unauthorized tampering with Acronis components, which may be part of an attempt to gain persistence, escalate privileges, or evade detection.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
This rule detects potentially malicious activity where multiple critical processes (such as database engines or email clients) are terminated in a short time frame, correlated with a high volume of file creation or modification events on the same device. This behavior is indicative of destructive activity, such as ransomware encrypting data stores or disabling defensive software.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
Detects suspicious modifications to browser 'Secure Preferences' files associated with known bypass techniques for extension integrity checks, coupled with browser process termination and subsequent relaunch using the --restore-last-session flag. This pattern is consistent with adversary activity attempting to inject malicious browser extensions by manipulating browser configuration files.
This rule detects Git repository modification events (such as pushes, branch creation, or reference creation) where the reference name matches a hexadecimal string (often indicative of a specific commit hash being pushed as a branch or tag) and the host is not github.com. This may indicate suspicious repository activity or interaction with non-standard or unauthorized code repositories.
Detects the creation or modification of specific system driver files (nvfsflt64.sys, Alinubx.sys) combined with the installation or initiation of a Windows service associated with NVIDIA filter names. This behavior is often indicative of persistence mechanisms, potential rootkit activity, or the deployment of vulnerable drivers (BYOVD).
This rule detects potential ransomware activity by correlating three distinct indicators: deletion of Volume Shadow Copies (using native Windows utilities), mass file modifications (>100 files in 15 minutes), and the creation or modification of files typically associated with ransom notes. The rule uses an inner join to ensure these events happen within a 30-minute window of each other on the same device.
This rule detects potential ransomware activity by correlating three distinct indicators: deletion of Volume Shadow Copies (using native Windows utilities), mass file modifications (>100 files in 15 minutes), and the creation or modification of files typically associated with ransom notes. The rule uses an inner join to ensure these events happen within a 30-minute window of each other on the same device.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects instances where 'TieringEngineService.exe' or 'MsMpEng.exe' (Windows Defender) create, modify, or rename executable, library, or system files within the 'C:\Windows\System32\' directory. This behavior is highly irregular as these processes should not be authoring binaries in protected system folders, and may indicate process masquerading, unauthorized persistence, or defense evasion.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
Page 31 of 110