Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the download of potential steganographic image files (specifically .jpg extensions) from known malicious IP addresses, followed by the creation of a non-Microsoft-signed image file in the C:\Windows directory by the same process storyline. This behavior suggests the download and extraction of an embedded malicious payload.
Detects activity associated with the RoguePlanet exploit, which involves creating EICAR content and NTFS Alternate Data Streams (ADS) within specific staging directories (wdtest_temp or RP_<UUID>). This behavior is intended to trigger Windows Defender scans and induce a TOCTOU race condition (CVE-2026-50656) by manipulating file operations near the wermgr.exe process.
Detects indicators of persistence on Linux systems, specifically targeting unauthorized cron job creation/deletion in /etc/cron.d/, execution of suspicious shell scripts (ssync.sh), modification of startup scripts (e.g., /etc/rc.d/cron), and execution of binaries from world-writable directories by cron or system daemons. This rule is designed to identify the footprint of known Linux-based persistence mechanisms associated with service account exploitation.
Detects anomalous file creation or modification events in sensitive Windows System32 directories originating from the Microsoft Defender process (MsMpEng.exe). Additionally, it detects when MsMpEng.exe spawns interactive shells (e.g., cmd.exe, powershell.exe), which is indicative of potential exploitation of vulnerabilities such as CVE-2026-33825, where attacker-controlled file operations are redirected via junction points.
Detects potential credential dumping activity targeting sensitive files like NTDS.dit, SAM, and SYSTEM hives. This rule monitors for three primary indicators: unauthorized invocation of vssuirun.exe (often used for Volume Shadow Copy manipulation), exploitation of print command utilities to access sensitive system files, and the staging of critical credential files into temporary directory paths.
This rule detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that hijacks browser search functionality. The detection monitors for three distinct indicators: the creation of specific extension files within the Chromium directory, network communication with attacker-controlled domains (perplexity-ai.online, extension.tilda.ws), and registry modifications that override default search settings.
Detects unauthorized or suspicious installation and configuration of the OpenSSH server on Windows endpoints. This rule monitors for process creation of OpenSSH-related binaries, configuration of SSH services (e.g., via sc.exe, PowerShell, or winget), and modification of SSH-related configuration files and registry keys, which are often indicative of attackers establishing persistent backdoor access.
Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.
This rule detects the installation, service configuration, and key management activities associated with the OpenSSH server on both Windows and Linux environments. It monitors for commands related to installing OpenSSH capabilities or packages, starting the sshd service, modifying SSH registry keys on Windows, creating or modifying configuration files (sshd_config), and updating authorized_keys files. It also flags inbound network connections to non-standard or default SSH ports originating from external IP ranges.
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
This rule detects post-exploitation activity related to the exploitation of PHP StreamBucket SOAP deserialization vulnerabilities. It monitors for child process execution from PHP web server processes (e.g., php-fpm, php.exe), the creation of specific proof-of-concept (PoC) marker files, and the presence of identified exploit script filenames on disk.
Detects the abuse of the CertUtil.exe Windows utility to download, decode, encode, or split files. This behavior is considered suspicious when initiated by common command-line shells or Office applications, which are frequently used as entry points for malicious scripts or macro-based attacks.
Detects exploitation activity associated with CVE-2025-8088 used by UAC-0226 (GIFTEDCROOK). The rule monitors for WinRAR-family archive tools dropping files into the startup folder, staging payloads into C:\ProgramData, and the subsequent logon execution chain where cmd.exe launches PowerShell to execute encoded commands or content from ProgramData.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
Detects indicators of Remcos RAT activity, specifically focusing on its use of native Windows utilities like attrib.exe, icacls.exe, and cmd.exe to modify file attributes, alter access control lists, or facilitate self-deletion. The rule also triggers when a identified Remcos-related process directly spawns these administrative tools for evasive actions.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects potentially malicious activity related to browser extensions, specifically targeting configuration file modifications (manifest.json, rules files) or the use of sensitive browser APIs (declarativeNetRequest, updateDynamicRules) that are commonly abused by malicious extensions. It also flags activity that includes keywords associated with affiliate/ad-click fraud platforms within command line arguments of major browsers like Chrome and Edge.
This rule monitors Cisco SD-WAN environments for indicators of post-exploitation, including unauthorized SSH lateral movement, abuse of administrative tools (vshell, confd_cli), suspicious tenant list modifications related to CVE-2026-20245, privilege escalation to backdoor accounts, system file tampering (/etc/passwd, /etc/shadow), and anti-forensic activities such as log and history deletion.
This rule detects indicators of exploitation for CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. It monitors for the upload of malicious tenant configuration files, the creation of unauthorized 'troot' administrative accounts, subsequent lateral movement via 'su', modifications to critical system authentication files like /etc/passwd or /etc/shadow, and post-exploitation configuration exfiltration via REST API endpoints.
Detects the creation of .amazonq/mcp.json or mcp.json files within repository directories following a git clone operation. This behavior is associated with the exploitation of vulnerabilities (such as CVE-2026-12957) where attackers use malicious job-interview repositories to trigger automatic execution of arbitrary MCP (Model Context Protocol) servers in the Amazon Q Developer extension in VS Code, potentially leading to unauthorized credential or sensitive data access.
This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.
Page 57 of 110