Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects evidence of the MYRA Linux RAT attempting to establish persistence via the LD_PRELOAD environment variable mechanism. The rule monitors for the creation or modification of specific malicious library files (libcache.so, .sh.local) and the execution of processes utilizing LD_PRELOAD to hijack dynamic linker operations.
This rule detects persistence mechanisms and fileless execution patterns commonly associated with the MYRA malware family on Linux systems. It specifically monitors for malicious cron job creation, LD_PRELOAD library manipulation, unauthorized shell profile modifications, and memfd-based execution spawned from Node.js or npm processes.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
Detects the execution of ServiceModelReg.exe followed by suspicious network or file system activity. ServiceModelReg.exe is a legitimate Windows utility that may be abused by adversaries for process hollowing or masquerading to evade defenses.
Detects the silent installation of Opera GX mods by correlating the rapid arrival of a .crx file followed by the creation of a manifest.json file within the Opera GX mods profile directory. This pattern indicates potential exploitation of the silent installation pipeline where an extension is added without explicit user confirmation prompts.
This rule detects potential web shell activity on ColdFusion or IIS servers by monitoring for the creation of known malicious file names typically associated with web shells and the execution of suspicious child processes (e.g., cmd.exe, whoami.exe, powershell.exe) by common web server worker processes (w3wp.exe, coldfusion.exe, jrun.exe). It also identifies suspicious command-line patterns referencing the web root directory.
Detects a suspected 5-step exploit sequence targeting CVE-2026-43503 on Linux systems. The rule monitors for unprivileged user and network namespace creation, followed by XFRM state modification, kernel module loading, raw ESP socket creation, and finally writing to /proc/[pid]/mem to facilitate page-cache corruption and bypass Copy-on-Write (CoW) protections.
Detects modifications to the AdminSDHolder object in Active Directory via Windows Security Event ID 5136. The AdminSDHolder object maintains the security permissions for all objects protected by the AdminSDHolder process. Adversaries often modify this object to establish persistence and gain unauthorized access to highly privileged accounts within the domain.
Detects suspicious execution of Node.js processes initiated by VS Code (or Cursor) that appear to be running JavaScript payloads disguised as font files (.woff2) or other suspicious assets. It also monitors for the creation or modification of '.vscode/tasks.json' files by package managers or source control tools, which could indicate the configuration of malicious 'folderOpen' tasks used for persistence or automated execution upon workspace opening.
Detects DcRAT malware creating or modifying a specific file (c:\debug.txt) used for staging keylogging or screenshot data. This rule monitors for file creation followed by modification events, a pattern associated with the adversary's method of log consolidation and potential obfuscation.
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
This rule detects screen capture activities associated with DcRAT, Millenium RAT, and Operation DragonReturn. It identifies the creation of specific staging files (e.g., debug.txt, background.jpg) at sensitive paths and monitors for non-standard or masquerading processes (such as svchost.exe running outside System32) that create image files in user-writable or temporary directories. The rule uses tiered logic, assigning a higher risk score to known IOC patterns and periodic capture behavior.
This rule detects file creation, modification, or module loading events involving specific DLL files ('msvcr90.dll' or '7z.dll') from a suspicious directory path ('Traiolx Custom Utils'). This behavior is commonly associated with DLL side-loading, where an adversary places malicious or renamed legitimate DLLs into a specific directory to hijack execution flow.
Detects the presence of known malicious Chrome extension IDs, suspicious configuration files (e.g., perplexity-rules.json, bing-rules.json), or extensions utilizing invasive declarativeNetRequest permissions, which are often used for browser-based exfiltration or credential interception.
This rule detects a two-stage DLL sideloading chain associated with Mustang Panda campaigns, specifically utilizing the SHARDLOADER and ZOHOMURK malware components. It monitors for the loading of malicious DLLs ('SolidPDFCreator.dll', 'ctxmui.dll') by specific binaries, as well as the execution of associated staging processes and file creation events in public directories.
Detects malicious activities associated with The Gentlemen RaaS group, specifically targeting GPO modifications to distribute ransomware, disable Windows Defender Real-time Monitoring, and deploy persistence mechanisms via scheduled tasks in SYSVOL or NETLOGON paths.
Detects the installation of the NexShield malicious Chrome extension, which impersonates uBlock Origin Lite. The rule monitors for the creation or modification of 'manifest.json' files within Chrome extension directories and registry key activity related to the extension's installation, specifically flagging references to 'NexShield' or deceptive 'uBlock Origin Lite' naming conventions.
Detects the exploitation chain of the DirtyClone (CVE-2026-43503) vulnerability on Linux systems. The rule monitors for a sequence involving an unprivileged user (UID > 1000) creating a new user/network namespace, configuring an IPsec XFRM state with loopback source/destination addresses, modifying sensitive memory via /proc/self/mem or /proc/<pid>/mem to bypass Copy-on-Write (CoW) protections, and ultimately spawning a process with root privileges.
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Detects the configuration and usage of personal Microsoft OneDrive accounts on corporate endpoints. This is achieved by monitoring for OneDrive process execution with personal account command-line arguments, OneDrive setup utilities configured with personal tenant identifiers, and file system activity within directory paths associated with personal OneDrive synchronization.
Detects the use of the Windows 'fsutil' utility with the 'setZeroData' argument to zero out file content. This technique is often used by adversaries to perform data destruction or prevent file recovery.
Page 62 of 110