Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects the creation or modification of generic executable files (e.g., 'me.exe', 'update.exe') within the Hola installation directory. It specifically looks for executables whose names match common updater or service patterns and whose process command line includes 'hola', 'update', or 'installer'. This activity could indicate a compromised delivery pipeline or supply chain attack, as observed with the Hola browser.
Detects the use of PowerShell commands that modify file system metadata (e.g., CreationTime, LastWriteTime, LastAccessTime). This technique, often referred to as 'timestomping', is used by adversaries to manipulate file timestamps to evade detection or hide activity.
Detects the use of attrib.exe with the '+h' flag to hide files or directories within common user-specific folders such as AppData, Temp, or Roaming. This activity is often associated with adversaries attempting to conceal their presence or malicious files.
Detects the creation or modification of suspicious macOS Launch Agents or Launch Daemons, specifically looking for patterns associated with the 'macOS.Gaslight' malware (e.g., 'com.apple.system.services.activity') or the creation of Launch Agents in user directories by processes masquerading as browser renderers (indicated by '--type=renderer' in the command line, excluding legitimate browsers). This rule aims to identify persistence mechanisms used by malware.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
This rule detects various activities associated with the SilverFox loader chain, including Defender exclusion modifications, suspicious child processes spawned from trojanized OEM binaries, VirtuOne DLL loading, scheduled task creation with specific names or unusual principals, creation of 'checktime.vbs' in public user directories, and masquerading of 'svchost.exe' in the Windows directory.
Detects StealC malware injecting into suspended chrome.exe or msedge.exe processes via APC injection to bypass Chromium App-Bound Encryption. The detection is correlated with the creation or modification of an IPC output file in C:\ProgramData\ with a specific naming convention (<HWID>.txt).
Detects attempts to restore or extract files containing path traversal characters ('../' or '..\') commonly associated with the ZipSlip vulnerability. This technique was utilized in Operation Escaneo (via the mkzip34.py tool) to deploy webshells automatically upon legitimate archive restoration. The rule specifically looks for file creation or modification events where the initiating process is a common archive extraction tool (unzip, tar) or a Java application server (java, tomcat), the file extension is for a Java web application (.jsp, .jspx), and the resulting folder path contains path traversal sequences.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Detects a shell script containing 'fanout' in its name, created or modified in common temporary directories like /tmp or /var/tmp, matching a reported propagation workflow. This activity is indicative of lateral movement attempts.
This rule detects potentially malicious lateral movement or persistence activities by monitoring the creation or modification of executable files in remote network shares and startup folders, as well as the use of administrative tools like sc.exe or schtasks.exe to create services or tasks. The rule specifically filters out processes signed by Microsoft, focusing on non-standard or unsigned binaries that perform these administrative actions across multiple instances, indicating potential automated lateral propagation.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects the creation, modification, or renaming of the `authorized_keys` file within the `.ssh` directory by processes other than common SSH key management or shell utilities. This activity could indicate an adversary attempting to establish persistence or elevate privileges by adding their own public key for SSH access.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects the creation or modification of specific SharePoint policy pages DLL files (microsoft.office.policy.pages.dll) that are known to be vulnerable to CVE-2026-45454. The detection is based on matching the SHA256 hashes of these vulnerable DLL versions. This indicates the presence or manipulation of a vulnerable component within a SharePoint environment.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule aggregates these file events by device and time, triggering an alert if 10 or more such files are observed within an hour on a single device, indicating a bulk encryption event.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Page 85 of 110