Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
Detects the creation or modification of specific file artifacts known to be used by the Remcos Remote Access Trojan (RAT). This includes persistent configurations or log files named 'keylogger.dat' or 'logs.dat' within the user's AppData/Roaming directories, which are characteristic indicators of Remcos activity.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
This rule detects the presence and execution of files associated with the proof-of-concept (PoC) exploit for CVE-2026-55200, a remote code execution vulnerability in libssh2. The rule monitors for specific exploit binary names and directory structures commonly used by security researchers or attackers to test or exploit this vulnerability.
Detects bulk file access or modifications in sensitive directories (Desktop, Documents, Downloads) targeting credential and document files (ovpn, kdbx, jks, eml, docx, xlsx, pdf), or direct PowerShell access to OpenVPN configuration or KeePass database files. This behavior is indicative of data staging or exfiltration activities associated with the GIFTEDCROOK stealer.
Detects execution of persistence-related commands such as cron job modifications or SSH key additions originating from development-related parent processes or installation commands like npm/pip. This behavior is indicative of potential supply chain compromises or malicious actors abusing development environments to maintain access.
EXPERIMENTAL: This rule detects RoguePlanet indicators when the Microsoft Defender Antimalware Service Executable (MsMpEng.exe) creates or modifies an executable (.exe, .dll, .sys) file within the System32 or SysWOW64 directories. This behavior can indicate a potential local privilege escalation (LPE) or other malicious activity, especially if Defender is being abused for remediation in a SYSTEM context. The rule specifically highlights 'wermgr.exe' as a high-interest target, but is generalized to catch any PE file.
Detects modifications or renames to critical Windows accessibility feature binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe) located in System32. Adversaries frequently replace these binaries with malicious counterparts or command shells to achieve persistence and gain SYSTEM-level execution via accessibility shortcuts at the logon screen.
Detects the execution of unauthorized processes or file modifications associated with the 'OpenVPN Connect echo script' vulnerability (ACE). This rule specifically identifies process creation events involving command-line arguments that attempt to trigger script execution on VPN disconnect, even when the software's script permission setting is disabled.
Detects the use of 'attrib.exe' to modify file attributes (specifically adding hidden or system attributes) on files with a '.dll' extension located in suspicious directories such as 'ProgramData', 'AppData', or other paths frequently used for persistence or file staging. This behavior is indicative of an adversary attempting to hide malicious artifacts.
Detects potential keylogging activity associated with Millenium RAT, characterized by the creation of log files with randomized 8-12 character filenames and folder names within the %APPDATA%\Roaming directory.
Detects the creation of a 'BackupFiles' directory and the subsequent copying of sensitive browser artifacts (e.g., Login Data, Web Data, Local Storage) within Chrome or Edge user data paths. This activity is indicative of credential and session theft staging, specifically associated with the ToddyCat group's Umbrij malware preparation for browser exploitation.
Detects the creation or modification of a file named 'maisum.dat', which has been associated with malicious activity and malware behavior.
Detects potential abuse of Active Directory Certificate Services (AD CS) by monitoring for suspicious command-line activity from 'certreq.exe' and 'certutil.exe' associated with certificate enrollment, submission, or management. It also identifies the staging of certificate-related files (.pem, .pfx, .p12, .crt, .cer, .key) in common user directories.
Detects post-exploitation persistence activity following a DirtyClone (CVE-2026-43503) privilege escalation. The rule monitors for the creation of local user accounts via binaries like useradd and usermod, as well as unauthorized modifications to sensitive Linux configuration files such as /etc/sudoers or /etc/shadow, specifically when executed with root-level privileges.
Detects unauthorized or suspicious modifications to critical Linux configuration directories (e.g., cron, rc, init, ipsec) or specific application-related paths by processes not typically associated with system management or package maintenance. The rule further elevates risk when specific indicators like LD_PRELOAD, LD_LIBRARY_PATH, or known malicious string artifacts are present in the command line or file path.
Detects anomalous activity associated with the RoguePlanet (CVE-2026-50656) exploit. The rule identifies suspicious file operations by MsMpEng.exe within temporary staging directories (RP_<UUID>), execution of non-Microsoft signed binaries from these staging paths, and unexpected file activity involving 'wdtest_temp' paths, which are indicative of an NTFS junction swap exploit sequence.
Detects signs of the VerdantBamboo threat actor's BRICKSTORM/PLENET campaign, specifically targeting Linux-based edge appliances like pfSense and Synology NAS. The rule monitors for sudo abuse by specific service accounts (e.g., egnyteservice, www-data) attempting to leverage NOPASSWD sudo privileges for the 'tee' utility to write malicious content into sensitive system files (e.g., /usr/sbin/, /etc/cron.d/, /etc/sudoers). Additionally, it identifies unauthorized sudo enumeration commands that may indicate early-stage reconnaissance or persistence efforts.
Detects the execution of QEMU processes, the presence of suspicious virtual disk files (e.g., .qcow2, .db) in unexpected locations, and the installation of Virtio drivers. These patterns may indicate an adversary is deploying hidden virtual machines to bypass host-based security controls.
Page 60 of 110