Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
Detects when the SSH daemon or associated client binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) are overwritten or newly created on a Linux system. This is a highly suspicious activity often associated with rootkits, backdoors, or persistence mechanisms aimed at intercepting credentials or maintaining unauthorized remote access.
Detects the use of package management or file integrity monitoring tools (rpm, dpkg, debsums, aide, inotifywait) to verify or interact with critical SSH/PAM configuration files, or the use of inotifywait to monitor SSH configuration access. This behavior may indicate an adversary attempting to verify compromised configurations, check for the presence of backdoors, or monitor security modifications.
Detects the creation or modification of the VbaProject.OTM file, which stores VBA macros for Microsoft Outlook, by a process other than the Outlook application (OUTLOOK.EXE). This is a common technique used to deploy malicious macros for persistence or code execution within the Outlook environment.
This rule detects modifications (such as write, rename, create, or delete events) to critical Linux system files including SSH binaries (sshd, ssh, scp) and PAM authentication modules (pam_unix.so). These files are common targets for adversaries seeking to establish persistence, bypass authentication mechanisms, or gain unauthorized access to credentials.
Detects instances where the legitimate Windows DllHost.exe process creates or modifies executable or script files in common directories frequently used for staging malicious payloads, such as public folders, temporary directories, and program data. This behavior is often associated with process injection or side-loading techniques where a trusted process is abused to drop secondary malicious files.
This rule monitors for suspicious activities related to Pluggable Authentication Modules (PAM) and authentication daemons. It detects unauthorized modifications to PAM configuration and shared object files, unexpected child processes spawned by sshd, the use of LD_PRELOAD in authentication contexts, and the tracing of authentication binaries (e.g., sshd, login, sudo) via strace.
Detects attempts to delete or clear Linux system logs using common utilities (rm, shred, truncate, echo, cat) targeting critical log paths such as /var/log/syslog, /var/log/messages, and other authentication or kernel logs. This activity is indicative of an adversary attempting to remove evidence of their actions from the local system.
Detects the use of the legitimate Windows utility fltMC.exe to perform timestomping (modifying file timestamps) on specific malicious or deployment-related files (such as FLTLIB.dll, scr.mui, and flt.bin) located in temporary directories. This activity is associated with the JFMBackdoor used by the Red Lamassu threat actor to evade timeline-based forensic analysis.
Detects potential indicators of an SSH/PAM backdoor. This includes three behaviors: 1) SSH-related system processes writing to suspicious file paths (e.g., /tmp, /dev/shm, or hidden files in user directories), 2) PAM sessions immediately followed by suspicious file writes, and 3) successful SSH authentications for usernames previously reported as 'Invalid' by the system, suggesting a tampered PAM module allowing arbitrary authentication.
Detects unauthorized write, modification, or rename operations within Linux Pluggable Authentication Module (PAM) directories (/lib/security, /lib64/security, /usr/lib/security, /etc/pam.d). The rule identifies activity performed by processes that are not recognized package managers (e.g., apt, yum, dpkg), which is a common technique used by threat actors to inject malicious authentication modules or backdoors (e.g., pam_unix.so replacement) to hijack authentication processes.
Detects the JFMBackdoor utility masquerading as fltMC.exe by executing from a non-standard location (typically %TEMP%) and performing timestomping operations via SetFileTime. This technique is used to manipulate MACE timestamps as an anti-forensic measure.
Detects the creation or modification of shared object (.so) files within critical Linux PAM library directories (/lib/security/, /lib64/security/, /usr/lib/security/) by processes other than identified system package managers. This behavior is indicative of an adversary replacing legitimate authentication modules with malicious versions to capture credentials or establish persistence, such as the activity documented in Operation Highland (Velvet Ant).
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
Detects evidence of file timestomping, a technique used by attackers to modify file system timestamps (Create, Access, Modify, Change) to evade forensic detection or masquerade malicious files. The rule monitors for explicit usage of timestomping tools (e.g., Invoke-TimeStomp), abuse of system utilities like fsutil.exe for timestamp modification by suspicious parent processes, and unauthorized or unsigned processes performing timestamp modification on sensitive file types.
This rule detects ransomware activity by identifying two primary indicators: a high volume of file renames to common ransomware extensions within a 5-minute window, and the creation of known ransom notes across multiple directories. It excludes processes signed by trusted vendors to minimize noise.
Detects high-frequency file creation, modification, or renaming activity within the user's Desktop directory. This pattern is often associated with ransomware activity, automated data exfiltration tools staging files, or malicious droppers unpacking payloads.
Detects file creation or modification events occurring within directories containing the string 'SysMain_5874288', which may indicate malicious staging of files, persistence, or tool deployment often associated with potentially obfuscated or specific adversary naming patterns.
Detects the creation or modification of .vscode/tasks.json files that contain configurations designed to execute tasks automatically upon opening a folder in VS Code, specifically utilizing 'runOn': 'folderOpen' combined with visibility-hiding attributes such as 'reveal': 'never' and 'echo': false. This pattern is commonly associated with supply chain attacks where malicious payloads are hidden within project configuration files.
Page 64 of 110