Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.
Detects modifications or creations of manifest.json files within specific directories associated with a browser extension. This behavior is often indicative of the installation or tampering of browser extensions by malicious actors to establish persistence, perform credential theft, or execute unauthorized actions within the browser context.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
Detects the execution of HFY.exe, a known component of the BeepRAT malware family, along with the presence of its associated sideloaded or dependency DLL files (e.g., data.dll, SQLite.Interop.dll). The rule monitors both process creation events and file system artifacts indicative of the malware's deployment.
This rule detects activities associated with the BeepRAT malware, including the execution of LuaJit.exe with specific command-line arguments (config.ini, temp.bin), the creation of staging files in the TCC local AppData directory, and parent-child process relationships involving a known dropper (HFY.exe). It also utilizes specific SHA256 hashes to identify known malicious BeepRAT binaries.
Detects BeepRAT malware activity, including network communication to its command-and-control (C2) server on port 18848 and the creation of screenshot or video artifacts by known loader processes (HFY.exe, LuaJit.exe, tcc.exe). It also monitors for unauthorized network connections to the known BeepRAT C2 IP address.
Detects unauthorized processes reading, creating, or modifying sensitive files associated with local AI development tools and assistants (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). This rule monitors for file operations outside of the known, legitimate AI tool processes, suggesting potential credential theft or configuration tampering by malicious software.
This rule detects the installation and activity of a malicious Google Chrome extension used to hijack the browser's default search provider. The rule triggers on a multi-stage process involving the creation of a specific malicious extension directory, modification of the Chrome Preferences file to change search settings, tampering with the 'PreferenceMACs' registry keys to bypass browser-based integrity warnings, and subsequent network communication with a known malicious C2 domain associated with the search hijack.
This rule detects potentially malicious activities related to the manipulation of Group Policy Objects (GPOs) within an Active Directory environment. It identifies the execution of scripts or processes that create, modify, or force GPO updates (e.g., using 'gpupdate /force'), the deployment of suspicious GPO-related files like 'deploy_gpo.ps1', the manual modification of 'ScheduledTasks.xml' within the SYSVOL directory, and the use of PowerShell to disable real-time monitoring via GPO configuration changes.
Detects potentially unauthorized or malicious Group Policy Object (GPO) modifications and deployment activities. This includes the creation or modification of GPO files on domain controllers (SYSVOL/NETLOGON shares), the use of specific PowerShell scripts associated with GPO deployment, execution of forced group policy updates, and attempts to disable real-time security monitoring via GPO context.
This rule detects potentially malicious child processes spawned by Node.js or npm, as well as specific file activity related to VS Code configuration or Node module directories that may indicate supply chain or development environment tampering. It flags processes like cmd.exe, powershell.exe, or python.exe being executed by code.exe or node.exe, and monitors for modifications to tasks.json or eslint-check files within sensitive directories.
Detects files or directories created beneath the PSEMHUB environment metadata transactions staging path, which could indicate data staging or server compromise. This rule specifically looks for file creation, modification, or renaming events within paths containing 'PSEMHUB.war' and '/envmetadata/transactions/' or '\envmetadata\transactions\'.
Detects modification of scripts in extension folders.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects the creation of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508.
Identifies the Potentially Unwanted Program (PUP) forcibly modifying Chrome or Edge extension directories or registry preferences to inject malicious stealers. This rule specifically looks for file creation or modification events within browser extension folders, initiated by common installer/updater executable names.
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
Page 82 of 110