Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects instances where 'TieringEngineService.exe' or 'MsMpEng.exe' (Windows Defender) create, modify, or rename executable, library, or system files within the 'C:\Windows\System32\' directory. This behavior is highly irregular as these processes should not be authoring binaries in protected system folders, and may indicate process masquerading, unauthorized persistence, or defense evasion.
Detects the 'ted' backdoor or similar malicious activity attempting to manipulate HAProxy's internal connection counters by accessing or writing to the HAProxy process memory (/proc/[pid]/mem or /proc/self/mem). This behavior is characteristic of an attempt to evade backend logging and statistics tracking by directly modifying process memory structures.
Detects attempts to tamper with Microsoft Windows Defender configuration, specifically by modifying exclusion paths via PowerShell cmdlets (Add-MpPreference, Set-MpPreference), direct registry modifications, or forced Group Policy updates. It also monitors for the disabling of Tamper Protection via registry and the creation of scheduled tasks designed to apply Defender exclusions.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects the creation, modification, or renaming of files within directories associated with GVFS (GNOME Virtual File System) or files masquerading as GVFS components. Adversaries often use these paths and file names to stage or hide malicious tools and persistence mechanisms on Linux systems.
Detects potential anti-forensic activities performed by malware, specifically the use of 'attrib.exe' to hide files and 'cmd.exe' with 'del /f /q' to forcibly remove dropped payloads. These actions are common indicators of a cleanup phase in a malware lifecycle to hinder analysis.
Detects the creation or modification of specific dropper/loader files and service worker registration within WordPress directory structures (wp-content/plugins, wp-content/themes, wp-content/uploads). These files are often associated with the injection of malicious scripts (e.g., on-chain resolvers) to facilitate drive-by compromises by site visitors.
Detects the use of the Windows 'copy /b' command to join multiple files into a single executable, specifically targeting patterns where document files are merged with a binary named 'Windowsupdate.exe'. This technique is often used to reassemble malicious payloads by combining split components or masquerading malicious content within seemingly benign file operations in temporary user directories.
Detects the use of the 'xattr' command to remove the 'com.apple.quarantine' extended attribute from a file. This attribute is used by macOS Gatekeeper to identify files downloaded from the internet and trigger security warnings. Removing it is a common technique to bypass Gatekeeper and execute untrusted software without user notification.
Detects attempts to remove the 'com.apple.quarantine' extended attribute from files on macOS using the 'xattr -d' command. This is a common technique used to bypass Gatekeeper's execution restrictions on downloaded files, allowing untrusted applications to run without security warnings.
Detects attempts to remove the 'com.apple.quarantine' extended attribute from files on macOS using the 'xattr -d' command. This is a common technique used to bypass Gatekeeper's execution restrictions on downloaded files, allowing untrusted applications to run without security warnings.
This rule detects the creation, modification, or renaming of a file named '/tmp/helper' within a one-day window of a 'curl' or 'wget' command-line execution that references this specific path. This pattern is commonly indicative of an adversary downloading and staging malicious tools or payloads in a temporary directory on Linux systems.
Detects creation or modification of the Faronics Deploy 'ScriptRunner.log' file. This artifact records script execution history and download URLs used by the Faronics Deploy management platform, which can be abused by adversaries for persistence or remote command execution.
Detects creation or modification of the Faronics Deploy 'ScriptRunner.log' file. This artifact records script execution history and download URLs used by the Faronics Deploy management platform, which can be abused by adversaries for persistence or remote command execution.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects the creation, modification, or renaming of files within directories associated with GVFS (GNOME Virtual File System) or files masquerading as GVFS components. Adversaries often use these paths and file names to stage or hide malicious tools and persistence mechanisms on Linux systems.
This rule detects when PowerShell is used to create or modify a LNK file within the Windows Startup folder. Adversaries often place malicious LNK files in this directory to achieve persistence, ensuring their code executes upon user login.
Detects the suspicious execution of a file named 'Windowsupdate.exe' located in 'AppData\Local' that is invoked via a command containing 'copy' and '/b'. This behavior is indicative of an attacker attempting to copy or stitch binary files using a masqueraded system process name to evade detection.
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.
Page 46 of 110