Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects high-frequency file creation, modification, or renaming activity involving files with the specific '.df_win' extension, likely indicative of mass encryption activity or automated ransomware behavior. The rule excludes known backup and security software processes to reduce noise.
Detects DragonForce ransomware note (readme.txt) referencing known DragonForce Tor negotiation/blog onion addresses
This rule detects potentially malicious activity where multiple critical processes (such as database engines or email clients) are terminated in a short time frame, correlated with a high volume of file creation or modification events on the same device. This behavior is indicative of destructive activity, such as ransomware encrypting data stores or disabling defensive software.
This rule detects file creation, modification, or renaming activity involving Acronis plugins integrated with web hosting control panels such as cPanel, WHM, or Plesk, where the plugin version is identified as vulnerable. It specifically monitors for versions earlier than 1.9.3 (excluding specifically patched 1.9.3 HF3 versions) that are prone to exploitation.
Detects the creation of an administrator-level user account in a WordPress environment within a one-hour window after the 'Admin Menu Editor Pro' plugin is updated to known trojanized versions (2.35 or 2.36), which is indicative of a backdoor installation.
Detects a sequence of suspicious behaviors on a single host within a 1-hour window, indicative of an adversary establishing a foothold and preparing for malicious activity. The pattern involves: 1) System architecture discovery, 2) Downloading files from an external IP address, 3) Changing permissions of files in temporary directories (e.g., /tmp, /var/tmp, /dev/shm), and 4) Executing files directly from those same temporary directories.
Detects a DLL file being created directly under C:\Windows\System32 by a process running at less than System integrity (not SYSTEM/TrustedInstaller). Legitimate System32 DLL writes are performed by installers or the OS itself running with SYSTEM privileges; a standard-user or low/medium-integrity process writing a new DLL into this protected path is consistent with the HardBreacher/SolidSnake local privilege-escalation exploit chain. Scoped on protected-directory + non-privileged-writer, not on filename, to generalize to renamed variants.
Detects PEEP Secure Preferences integrity-hash forgery (protection.macs/super_mac) and known PEEP persistence scripts (patch_secure_prefs.ps1, install_silent.ps1, force_enable.ps1), anchored to actual Chrome/Edge profile paths rather than generic terms like 'protection' or 'developer_mode' that appear in unrelated admin tooling.
This rule detects potential ransomware activity by correlating risky user identity events (such as impossible travel or malicious IP access) with subsequent endpoint behavior typical of ransomware, specifically the deletion of shadow copies or system backups, or mass file modification activity occurring within a short window.
This rule detects potential ransomware activity by correlating risky user identity events (such as impossible travel or malicious IP access) with subsequent endpoint behavior typical of ransomware, specifically the deletion of shadow copies or system backups, or mass file modification activity occurring within a short window.
This rule monitors for three distinct suspicious behaviors on Windows endpoints: the addition of executable files from temporary or user-writable directories to Windows registry run keys for persistence, the creation of repeated hidden log or data files in AppData directories, and unsigned processes accessing browser-related credential storage files.
Detects package manager processes (npm, pip, python) executing install-related commands followed by the creation or modification of sensitive files (SSH keys, cloud credentials, shell configurations) within a short timeframe. This behavior is indicative of potential supply chain attacks where a malicious package attempts to steal credentials or secrets upon installation.
Detects unauthorized modifications to critical authentication-related configuration files and registry keys. Specifically monitors changes to LSA security packages and notification packages on Windows systems, as well as PAM configuration file modifications on Linux systems, when performed by unsigned or untrusted processes outside of known installer activity.
Detects the creation, modification, or renaming of unsigned executable files (.exe, .dll, .sys, .efi) within critical Windows system directories (System32, SysWOW64, drivers, boot). The rule excludes activity triggered by known trusted OS update processes, such as TrustedInstaller or Windows Update services, and optionally flags occurrences outside defined maintenance windows.
Detects multiple methods of tampering with Windows security controls, including disabling Windows SmartScreen via registry, bulk removal of Mark-of-the-Web (Zone.Identifier) via scripting, and disabling driver signature enforcement (TestSigning/NoIntegrityChecks) using BCDedit. These actions are indicative of an adversary attempting to bypass security protections to facilitate the execution of untrusted or malicious code.
Detects the creation or modification of files within the /etc/init.d/ directory, followed by process activity related to that same directory. This pattern is commonly associated with attackers establishing persistence on Linux systems via SysVinit scripts.
This rule detects potential ransomware activity by correlating three distinct indicators: deletion of Volume Shadow Copies (using native Windows utilities), mass file modifications (>100 files in 15 minutes), and the creation or modification of files typically associated with ransom notes. The rule uses an inner join to ensure these events happen within a 30-minute window of each other on the same device.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
This rule detects a suspicious sequence of events where a process with a name resembling an updater (AutoUpdate.exe or au.exe) accesses a specific remote configuration file from a herokuapp.com URL, followed by the creation or modification of specific application binaries (e.g., InstaTime.exe, ffmpegsumo.dll). This pattern is indicative of a supply chain compromise or an automated software update hijacking where malicious binaries are staged to replace legitimate application components.
Detects the creation, modification, or renaming of PHP files within the 'wp-content/uploads' directory of a WordPress installation. This pattern is commonly indicative of an attacker uploading a web shell to maintain persistence or execute arbitrary code on a compromised web server.
Detects modifications to the PostgreSQL configuration file 'pg_hba.conf' closely followed by a reload command (via pg_ctl or postgres processes). This behavior is indicative of an attacker attempting to modify authentication or connection access controls for a database.
Page 36 of 110