Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects potential exploitation of ImageMagick vulnerabilities where Ghostscript delegates are used to achieve arbitrary code execution. The rule monitors for suspicious Ghostscript command-line arguments (e.g., missing or disabled -dSAFER), child process creation (spawning shells or interpreters), execution of network tools, unauthorized file modifications with script/binary extensions, and outbound network connections initiated by Ghostscript processes.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity is often used by adversaries to establish persistence on compromised WordPress sites by injecting malicious code.
Detects file creation or modification events associated with the known malicious Chromium extension 'Search for perplexity ai' (ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for the installation of the extension and the creation of its declarativeNetRequest rule files (perplexity-rules.json, bing-rules.json, google-rules.json), which are used to hijack browser search queries and redirect them to a typosquatted domain.
Detects unauthorized persistence mechanisms on Cisco SD-WAN management plane nodes (vManage, vSmart, vBond). The rule monitors for modifications to SSH authorized_keys files, execution of commands like ssh-keygen or user management utilities, and SSH authentication events or configuration changes (e.g., PermitRootLogin) indicative of backdoored access.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
This rule detects activities indicative of a Docker container escape, specifically targeting the 'docker cp' path traversal vulnerability. It monitors for suspicious command-line patterns involving path traversal sequences ('../'), execution of shells or common utilities from container-related processes (dockerd, containerd, etc.), and the presence of known proof-of-concept artifacts or files written outside the expected container boundary.
Detects a sequence of events indicative of LSASS memory dumping followed by lateral movement via SMB administrative shares. The rule monitors for suspicious OpenProcess calls targeting lsass.exe, the subsequent creation of dump files in temporary directories, and concurrent access to admin shares (ADMIN$ or C$) from the same host, which is a common pattern for credential harvesting and lateral movement tools like 'lsassy'.
This rule identifies potential ransomware activity by detecting a process performing a high volume of file rename or modification operations within a short time window. It specifically targets files with known ransomware extensions or those using randomized 6-8 character alphanumeric extensions, while excluding common administrative, backup, and temporary file operations performed by trusted software.
Detects JavaScript using the 'ghost_once_footer_' key with localStorage read and write operations, indicative of potential web-based attacks leveraging compromised Ghost CMS instances. This rule specifically looks for the string 'ghost_once_footer_' in conjunction with 'localStorage.getItem' and 'localStorage.setItem', suggesting a mechanism for persistent or one-time data storage in the browser's local storage.
This rule detects the creation or modification of specific files associated with known malicious activity or remote access tools, specifically looking for shortcut files (LNK) named 'ApplianceConfig', 'ServerConfig', 'CredentialsConfig', or AnyDesk configuration files ('anydesk_svc.conf', 'anydesk_usr.conf'). These file patterns are often used by threat actors for persistence or to facilitate remote control.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
Detects 7-Zip (7z.exe / 7zG.exe) writing executable files to user-accessible directories, potentially leveraging CVE-2026-46331. This vulnerability allows an adversary to manipulate the Zone.Identifier Alternate Data Stream (ADS) of extracted files by embedding a crafted RAR5 stream, effectively setting the ZoneId to 0 (My Computer) and bypassing Windows SmartScreen warnings upon subsequent execution.
Detects the presence and execution of the 'mybb_limited_acp_to_admin' PoC script, as well as suspicious child process creation originating from web server or PHP processes when the command line includes 'admincp'. This is indicative of potential web exploitation or the use of a web shell within the MyBB Administrative Control Panel environment.
Detects the creation or modification of shell script files within known Linux system persistence directories ('/etc/profile.d/' and '/usr/local/lib/') that contain specific naming patterns (' .sh.local' or '.cache-update.sh'). This activity often indicates an attempt to establish persistence or inject code that executes upon user logon or system initialization.
Detects the Chromelevator loader, identified as 'drun.exe', performing reflective DLL injection of 'payload.dll' using direct syscalls (NtAllocateVirtualMemory, NtCreateThreadEx) and inter-process communication (IPC) via a named pipe ('__DLL_PIPE_COMPLETION_SIGNAL__'). The rule looks for process creation, remote thread creation, memory protection modifications, file creation/modification of 'payload.dll', and specific named pipe events associated with 'drun.exe'.
This rule detects the deployment and activity associated with the TrueSightKiller rootkit, potentially used by threat actors like SilverFox. It identifies several key indicators: the loading of 'truesight.sys' from non-standard directories, the creation of a staging file named 'ranchserv.jpg' in the Windows Temp directory by non-system processes, the presence of the 'truesight.sys' driver based on its known SHA256 hash, and the termination of security products shortly after the creation of TrueSightKiller-related artifacts.
Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.
Detects suspicious activity on Cisco SD-WAN infrastructure (vManage, vSmart, vBond) associated with unauthorized configuration changes, potential exploitation of CVE-2026-20245, rogue account creation, and anti-forensic behaviors.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Page 67 of 110