Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects unauthorized installation, service creation, and registry modifications associated with the RustDesk remote access tool. The rule monitors for command-line activity indicating the installation of RustDesk as a service, execution of installation scripts, and imports of configurations from non-standard locations, which may indicate the deployment of unauthorized remote access software for C2 purposes.
Detects the creation or execution of the SysAid.exe binary, which is a legitimate Remote Monitoring and Management (RMM) tool. Adversaries may abuse such tools to establish persistence, gain unauthorized remote access, or facilitate further malicious activities within an environment.
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
Detects instances where a file named 'config.txt' is created, modified, or renamed. This pattern is commonly used by attackers to stage configuration files, drop payloads, or modify application settings.
Detects a specific exploit pattern where a malicious process triggers Microsoft Defender (MsMpEng.exe) to write a quarantine artifact to a user-controlled directory (such as a TEMP subdirectory), which is then immediately overwritten by an unprivileged process. This behavior indicates an attempt to exploit the Defender quarantine pipeline for unauthorized file manipulation or potential privilege escalation.
Detects instances where the same file (identified by SHA256) with common lure names like 'resume', 'headshot', or 'faceswap' is being created or modified by multiple different users across the environment. This behavior is often indicative of an adversary distributing malicious files or a coordinated effort to access sensitive or tempting filenames, potentially related to social engineering or lateral movement.
Detects execution of Node.js applications that utilize specific Jscrambler obfuscation versions or the presence of these versions in package.json files, which may indicate the use of compromised or unauthorized supply chain dependencies.
Detects file creation, modification, or renaming events within sensitive macOS Application Support directories that mimic core system components such as Finder or Software Update. This behavior is indicative of potential masquerading or persistence techniques where an attacker replaces legitimate application resources with malicious ones.
This rule detects potential malicious activity where PowerShell is used to write base64-encoded files disguised with non-script extensions (e.g., .ini), which are subsequently decoded using 'certutil.exe -decode' and executed via 'wscript.exe'. This chain is a common technique used to bypass security controls by obfuscating script content and utilizing legitimate system binaries for deobfuscation and execution.
Detects the creation or modification of Fortinet VPN-related configuration, command, or script files on a system. Attackers may target these files to gain unauthorized access, modify VPN parameters, or extract sensitive connection information.
This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.
Detects the presence of HijackLoader/IDAT Loader payloads disguised as non-PNG files. The rule identifies files containing concatenated PNG IDAT chunks that do not start with a valid PNG magic header, followed by a canonical IEND terminator, characteristic of steganographic data storage used to deploy the HijackLoader toolkit.
Detects high-volume file modification events resulting in files renamed with the .inc extension, which is a characteristic behavior of the INC ransomware strain. The rule monitors for more than 50 such modifications on a single host within a 10-minute window, serving as an indicator of active encryption and potential ransomware impact.
Detects the creation or modification of a file named 'log.txt' within a 'ProgramData' directory by the 'FortiEndpoint_Patch.exe' process. This pattern may indicate the diagnostic logging activity of the FortiEndpoint patch mechanism.
Detects a sequence of actions on macOS where an attacker removes the quarantine extended attribute (com.apple.quarantine) using 'xattr' and subsequently performs ad-hoc code signing using 'codesign' on the same system. This behavior is indicative of an attempt to bypass macOS Gatekeeper security controls to execute untrusted or malicious binaries.
Detects file activity (creation, modification, copying, or renaming) within the 'leveldb' directories of popular web browsers (Chrome, Edge, Brave, Opera) and Discord applications by processes other than the legitimate application executables. This behavior is highly indicative of credential theft or data staging, often associated with malware attempting to extract browser session cookies, local storage databases, or stored credentials.
Detects the creation or modification of a file named '.config' within the path 'Library/Application Support/com.apple.finder.core/'. This behavior is indicative of potential persistence mechanisms, as adversaries often use hidden files within application support directories to maintain foothold or store configurations on macOS.
Detects a malicious HTA lure disguised as a military pay calculator. The attack involves a JScript routine that renames an embedded data file ('styles.dat') to an executable ('styles.dat.exe') and triggers its execution, characteristic of a spearphishing attachment delivering malware.
Detects the execution of Certutil.exe with specific command-line arguments (-decode, -urlcache, -split) or references to suspicious file patterns (Link.dat, Link.ini) which are often indicative of malicious activity such as downloading remote payloads, decoding obfuscated binaries, or staging files for lateral movement.
Detects the EKZ Stealer malware masquerading as a legitimate Fortinet update process (FortiEndpoint_Patch.exe). The rule monitors for the execution of this specific filename or hash, identifies suspicious command-line arguments (list, search, view, label, export) indicating credential theft activities, and alerts on the creation of the binary and subsequent log files within the ProgramData directory.
Page 54 of 110