Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,457
11,841
5,879
5,158
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.
Detects suspicious modifications to GitHub Actions workflows, such as unauthorized file overwrites, commits by bot impersonation identities (e.g., dependabot, renovate), or the upload of sensitive artifacts like 'format-results.txt'. These activities are indicative of IronWorm-style attacks targeting CI/CD pipelines to exfiltrate secrets via build artifacts.
Detects anomalous behaviors associated with malicious npm package self-upgrades, where node.exe modifies its own source files within node_modules or spawns npm pack commands to replace existing dependencies with malicious versions.
Detects indicators of the BUMSRAKETE FreeBSD kernel-level exploit (CVE-2026-45257). This rule monitors for exploit artifact file creation, malicious use of dd to overwrite SUID binaries for privilege escalation, kernel configuration enumeration via sysctl, spawning of shell processes with root UID from suid-related binaries, and kernel version fingerprinting.
Detects the creation of a potentially malicious shared library (libcache.so) in /usr/local/lib followed by a modification of the /etc/ld.so.preload file on Linux systems within a short time frame. This technique is commonly used for persistence and code injection, where the dynamic linker is forced to load the malicious library before others.
Detects indicators of persistence via dynamic linker hijacking on Linux systems, specifically looking for the creation or usage of .libcache.so, modifications to /etc/ld.so.preload, hidden shell profile droppers, or node process execution utilizing LD_PRELOAD variables.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects potentially suspicious process creation or file modification activities associated with Autodesk applications or generic 'appcompat' paths. The detection logic flags processes executing with the '-uiDll' command-line argument and specific file operations (Creation/Modification) involving configuration or log files, often associated with unauthorized software tampering or suspicious binary execution patterns.
Detects the exploitation of the CVE-2025-8088 vulnerability in WinRAR, where a path traversal technique is used to extract malicious files directly into the Windows Startup folder. This pattern is associated with threat actors like Gamaredon to achieve persistence, typically by placing HTA downloaders that execute upon user logon.
Detects instances where DllHost.exe creates or writes executable, script, or library files into common user-writable directories (e.g., C:\Users\*, C:\ProgramData\*, C:\Temp\*). This behavior is often associated with file staging or the delivery of malicious payloads. The rule also checks if the DllHost.exe process was spawned by WSL (Windows Subsystem for Linux) related processes, which can be indicative of cross-environment execution or evasion techniques.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
Detects file creation or renaming events associated with JFMBackdoor, including unauthorized file manipulation in common system locations and the presence of known backdoor component filenames. It also monitors for suspicious file attribute manipulation performed by processes running from temporary directories.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
Detects the execution of manage-bde.exe with command-line arguments designed to enable encryption, disable/delete BitLocker protectors, or modify authentication keys. This pattern is indicative of ransomware abuse, specifically actors attempting to encrypt drives and destroy recovery capabilities, particularly when spawned from scripting or shell environments like PowerShell, CMD, or WMI.
This rule monitors for potential abuse of the Microsoft Management Console (mmc.exe) to proxy malicious activity. It detects three primary behaviors: 1) mmc.exe being launched with a .msc file originating from user-writable or suspicious directories; 2) mmc.exe spawning known suspicious child processes (e.g., powershell.exe, cmd.exe, rundll32.exe); and 3) the creation or modification of .msc files in suspicious locations by processes other than mmc.exe or msiexec.exe.
Detects potential dynamic linker hijacking on Linux systems by monitoring for the use of non-standard LD_PRELOAD paths in process command lines or unauthorized modifications to the /etc/ld.so.preload configuration file, which can be used to inject malicious code into processes.
Detects techniques used by adversaries to hide files, directories, or modify access permissions on Windows systems. This includes the use of 'attrib.exe' to set the hidden attribute, PowerShell cmdlets to set file attributes, 'icacls' to modify or deny permissions, and the creation of hidden Unix-style dot-prefixed files within common Windows user directories.
Detects evidence of file timestomping, a technique used by attackers to modify file system timestamps (Create, Access, Modify, Change) to evade forensic detection or masquerade malicious files. The rule monitors for explicit usage of timestomping tools (e.g., Invoke-TimeStomp), abuse of system utilities like fsutil.exe for timestamp modification by suspicious parent processes, and unauthorized or unsigned processes performing timestamp modification on sensitive file types.
Detects the execution of manage-bde.exe with command-line arguments designed to enable encryption, disable/delete BitLocker protectors, or modify authentication keys. This pattern is indicative of ransomware abuse, specifically actors attempting to encrypt drives and destroy recovery capabilities, particularly when spawned from scripting or shell environments like PowerShell, CMD, or WMI.
Detects potential exploitation of Firefox SmartWindow (CVE-2026-20253) involving token exfiltration via specific URL patterns, unauthorized configuration preference tampering (e.g., smartwindow.enabled, smartwindow.apiKey), or modifications to browser configuration files (prefs.js, user.js) by the Firefox process.
Page 59 of 110