Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the use of the Windows 'attrib.exe' utility to set the hidden (+h) attribute on files or directories within 'ProgramData' or 'AppData' paths. This behavior is frequently associated with the Mustang Panda threat group to conceal malicious artifacts, such as the SHARDLOADER and ZOHOMURK implants, from standard user visibility.
Detects access or modification of cloud provider credential and configuration files by common script interpreters or code editors (python, node, vscode), which may indicate credential theft or misuse by an adversary.
Detects the creation or modification of suspicious Launch Agent or Launch Daemon .plist files, or a hidden application support directory, masquerading as 'com.apple.accountsd' on macOS. This behavior is often indicative of persistence mechanisms used by adversaries.
Detects modification of shell profile files for command execution on login
Detects use of Linux extended attributes to hide malicious data
This rule detects the creation or modification of specific script files in common Linux persistence locations: '/etc/profile.d/' or '/usr/local/lib/'. Adversaries may modify or create scripts like '.sh.local' or '.cache-update.sh' in these directories to establish persistence, as these scripts can be executed automatically during system boot or user login.
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Detects the creation or execution of suspicious LNK files masquerading as legitimate AnyDesk or N-able RMM configuration files (e.g., ApplianceConfig.lnk, ServerConfig.lnk) and unauthorized access to AnyDesk service or user configuration files (anydesk_svc.conf, anydesk_usr.conf). This behavior is associated with MexicanMafia's 'Operation Escaneo' for establishing persistent, low-visibility remote access.
This rule detects the execution of scripts and commands associated with known SAP RFC exploitation attempts, including specific shell scripts used for RCE or credential extraction, as well as the invocation of SAP function modules like SXPG_CALL_SYSTEM for OS command execution. These patterns are consistent with post-exploitation activity or unauthorized system administration in SAP environments.
This rule detects activities associated with CORS-based exploitation and session token harvesting, specifically targeting the creation or access of known exploit files (e.g., cors_exploit_poc.html) and the use of command-line tools (curl, wget, PowerShell) to interact with suspicious artifacts or session tokens (AMAUTHID/SAT).
This rule detects the execution of specific shell processes (sh, bash, crontab) where command-line arguments reference suspicious paths commonly associated with persistence mechanisms or malware, such as /var/tmp/ files or crontab spool directories.
This rule detects post-execution activity associated with the lambsys/isp.sh cryptominer campaign. It triggers when a known miner binary (lambsys, procq, or isp.sh) is executed, followed within 3 minutes by suspicious cleanup operations including the deletion of log files (wtmp, btmp, system logs), staging directories, or tampering with command history files and shell environment variables.
This rule detects suspicious manipulation of Linux namespaces using the 'unshare' utility or manual modification of user ID mapping files ('uid_map', 'gid_map', 'setgroups') in '/proc/self/'. Such activities are characteristic of container escape attempts or privilege escalation, where an attacker seeks to gain root access on the host or map unprivileged users to privileged IDs within a new namespace.
Detects execution of sensitive administrative binaries (rm, chmod, chown) targeting critical system files or directories, or direct interaction with sensitive system files and configuration logs which may indicate unauthorized data access or evidence tampering.
Detects the 'Adblock for YouTube' browser extension (specific ID cmedhionkhpnakcndndgjdbohmhepckk) performing suspicious file system operations related to the injection of remotely-fetched scriptlets into the browser's MAIN world. This activity is indicative of an attempt to bypass browser security boundaries to access session cookies, local/session storage, and login form data.
Detects suspicious user account creation activity or direct modification of the /etc/passwd file. The rule flags the use of 'useradd' or 'adduser' commands, as well as unauthorized attempts to inject root users into the passwd file, specifically looking for indicators like 'troot' (a common misconfiguration or backdoor username pattern).
Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects a suspicious sequence of events attributed to APT37, where a HWP or HWPX decoy file is written to user-accessible staging directories (Downloads, Temp, Desktop, Public) followed by the execution of a .lnk file using cmd.exe or explorer.exe within 30 seconds on the same device.
This rule detects the creation of files or directories associated with known suspicious or malicious browser extension IDs within the Microsoft Edge User Data folder. It monitors for the writing of new executables, scripts, or directory creation events that match specific, potentially malicious extension GUIDs.
Detects the silent activation of the 'Smart Window' feature in Mozilla Firefox. The rule monitors for a two-stage sequence where Firefox modifies its 'prefs.js' configuration file to enable the feature, followed shortly by a network connection to the local Smart Window AI API on localhost port 8765.
Page 73 of 110