Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects a sequence of events indicative of an MSI rollback attack, where an attacker triggers an MSI installer error, modifies the associated .rbs (rollback script) file in the C:\Config.Msi folder using a non-msiexec process, and subsequently executes the modified script (poc.cmd) to achieve unauthorized code execution with elevated privileges.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects the mrmustard stealer's compiled-bytecode artifacts (hw_probe.pyc, .lock_*, .ts_*) dropped in the hidden .tf_cache directory used to evade static source-code review.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects the creation or renaming of .rbf (Rollback File) files within the C:\Config.Msi directory where the previous filename was 'marker.txt'. This behavior is associated with the Windows Installer service (msiexec.exe) and can be leveraged by adversaries to perform file operations or execute arbitrary code during installation processes.
Detects creation or modification of a shell profile (.bashrc/.zshrc/etc.) containing the exact 'tensorflow hardware compatibility check' marker used by the mrmustard stealer to disguise its persistence hook.
Detects instances where a process other than msiexec.exe performs directory change operations (ReadDirectoryChangesW) within the 'C:\Config.Msi' folder. This path is often used by the Windows Installer, and unauthorized access to this directory can indicate suspicious activity related to DLL sideloading or persistence mechanisms.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects suspicious modifications to Windows Boot Configuration Data (BCD) using bcdedit.exe by unsigned or non-standard processes outside defined maintenance windows. This behavior is associated with the Dolphin X malware's bootkit persistence module, designed to gain control before the operating system initializes.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the creation or modification of Windows Registry Run keys that point to OCX (ActiveX Control) files located within user-writable AppData directories. This behavior is associated with the persistence mechanisms of various malware families, including TinyEgg, ChonkyChicken, and ChromEggscalator, which often utilize the 'WinComCtl' value name to maintain execution across system reboots.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects file creation, modification, or renaming operations involving .rbs or .rbf files within the 'C:\Config.Msi' directory when the process performing the action is not 'msiexec.exe'. Adversaries may attempt to manipulate MSI rollback or installation files to achieve persistence or execute arbitrary code during the installation process.
This rule detects file-level activity associated with the known malicious version of the ModHeader browser extension (Extension ID: idgpnmonknjnojddfkpgkljpfnnfcklj). It flags the presence of specific indexedDB LevelDB files and temporary directories that are characteristic of the malicious update, which was used for unauthorized data access and browser-based persistence.
Detects the use of the bindutil utility to create a link or redirection for a DLL path. This behavior is often associated with modifying search paths or redirecting DLL dependencies in container or virtualization environments. The rule excludes common, legitimate system and container processes that use bindutil for path management.
Detects unauthorized processes (non-msiexec.exe) modifying registry keys related to TempPackages alongside simultaneous modification or interaction with .rbs or .rbf files located within the C:\Config.Msi directory. This behavior is indicative of potential MSI installer hijacking or tampering attempts where an adversary attempts to bypass standard installer execution paths.
This rule detects when a web server process (such as apache, httpd, or php-fpm) modifies or creates a new PHP file within common WordPress directories (plugins or themes). This behavior is often indicative of an attacker attempting to plant a web shell to gain or maintain persistent access to a compromised server.
Page 51 of 110