Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
Detects unauthorized persistence mechanisms on Cisco SD-WAN Manager, vSmart, and vBond nodes by monitoring for local account creation (e.g., useradd), modification of sensitive authentication files (/etc/passwd, /etc/shadow), and illicit SSH key placement in authorized_keys. This rule specifically monitors for known exploit paths involving the 'troot' account and related command-line activity indicative of unauthorized administrative access.
Detects the creation or modification of specific suspicious .pyd files (Python extension modules) within temporary directory paths, excluding legitimate processes or publishers associated with Python Software Foundation or Microsoft Corporation. This behavior is indicative of potential side-loading or persistence mechanisms involving malicious Python extensions.
This rule detects anomalous activities associated with RustDesk, such as spawning suspicious child processes, dropping files related to known session permission bypass proof-of-concepts, communicating with non-standard relay servers, or performing file write operations in sensitive system temporary directories, which indicates potential session hijacking or unauthorized remote access.
Detects unauthorized writes to the /proc/sys/vm/drop_caches interface by non-root users or processes that are not standard system maintenance tools. This activity is a known post-exploitation technique used by exploits like the 'pedit' COW exploit to clear cached setuid binary pages in memory for evasion or cleanup.
Detects anomalous, high-volume file creation patterns in temp directories characterized by UUID-style filenames from non-system processes. This behavior is indicative of a multi-threaded I/O saturation technique used by the RoguePlanet exploit to create a race condition (TOCTOU) against Microsoft Defender (MsMpEng.exe).
Detects unauthorized modifications to FreeBSD init scripts located in /etc/rc.d/, /usr/local/etc/rc.d/, or /etc/rc.subr. These directories are used for system service startup. The rule specifically monitors for modifications related to the BRICKSTORM persistence mechanism, which targets these scripts to execute malicious binaries such as /usr/local/libexec/ipsec/blacklist.
This rule detects potentially malicious activity related to the cron utility, including the modification of cron-related configuration files and the execution of specific suspicious payloads (e.g., ssync.sh, blacklist). It monitors for file creation, modification, or renaming events within sensitive directories, as well as the spawning of processes by cron daemons using identified suspicious paths or command names.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects credential harvesting behavior associated with the BQTLock (BaqiyatLock) malware, including the staging of password files in temporary directories, unauthorized access to browser credential stores (e.g., Login Data, key4.db), and the use of system utilities like vaultcmd.exe to interact with the Windows Credential Manager. It also monitors the execution of PyInstaller-packed loaders (BQT.exe or start.exe) from temporary directories.
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
This rule monitors Sysmon Event ID 11 (FileCreate) to detect high-volume file creation activity across multiple unique directories. By filtering out common file types, it identifies potential signs of mass file modification, staging for exfiltration, or malicious encryption characteristic of ransomware or data destructive operations.
Detects potential execution of a Tox ransomware negotiation channel by monitoring for processes that exhibit a high rate of file writes (potential encryption activity) in conjunction with command-line arguments containing specific patterns such as a 76-character string or the 'tox://' URI scheme, which are associated with Tox ransomware client activity.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.
This rule detects potentially malicious activity related to cron job scheduling. It monitors for three distinct stages: (1) direct modification of crontab files or directories using common shell utilities, (2) suspicious file write operations to critical cron configuration paths, and (3) execution of shell scripts or binaries from unusual directories (e.g., /tmp, /dev/shm) where the parent process is a cron utility.
Page 63 of 110