Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects unauthorized file writes to specific Google Chrome extension directories associated with the VILE ransomware. The rule monitors for file creation or modification events targeting known extension paths or files with the .vile extension suffix, indicating potential persistence or malicious extension installation.
This rule detects indicators of the Grixba v2/v3 ransomware group, specifically identifying the presence and execution of sideloaded XOR-encrypted payloads (inf_g.dll) and the utilization of specific reconnaissance file staging paths within C:\Users\Public\Music\, including the identification of malicious binaries masquerading as gt_net.exe.
This rule detects potential web shell activity on Windows IIS servers by monitoring for two suspicious behaviors: the w3wp.exe process spawning shell processes (cmd.exe or powershell.exe) and the creation or modification of .aspx files within common web root directories (\wwwroot\, \inetpub\). These are common indicators of web shell installation and subsequent remote command execution.
Detects potential DLL sideloading attempts where a malicious 'Mixed Reality.exe' loads a 'nvdaHelperRemote.dll' from the Windows Media Player directory, or the creation of these suspicious files by unrecognized processes, potentially linked to a dropper file 'COU_ITR-1_to_4_AY2026-27.exe'.
Detects indicators of the DcRAT malware associated with Operation DragonReturn. The rule monitors for the creation of the specific DcRAT mutex 'Global\ShitSetupOn26126k', the execution of a malicious process disguised as the Windows Media Player 'Mixed Reality' utility, and the sideloading of the 'nvdaHelperRemote.dll' file within the Windows Media Player directory, which are techniques used for sandbox evasion and persistence.
Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.
Detects a non-browser process creating copies of at least three Chromium credential or browsing databases in a temporary, roaming, public, or program-data directory. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Detects the unique XOR decryption routine logic utilizing the actor's embedded Session messenger identifier as the key string. This rule specifically looks for file creation or modification events of '.pth' files, correlated with process command lines containing 'contact [alphanumeric] on session'.
This rule detects a specific command-line pattern executed via `cmd.exe` that is associated with the ClickFix attack. The pattern involves moving an `update.zip` file from the user's downloads directory, extracting a `u.zip` file in the temporary directory using `tar`, and then executing an `update.bat` script. This sequence of actions is indicative of a multi-stage malicious payload deployment.
This rule detects potential persistence and execution of suspicious VBScript files ('Telegram_Private_Call_Session.vbs' or 'assurance.vbs'). It monitors for the creation or modification of these files within the Windows Startup folder, their execution via wscript.exe, and the creation of corresponding registry entries to ensure automatic startup.
Detects execution of the Prinz Eugen ransomware 'servertool.exe' accompanied by high-volume file modifications targeting files with the '.prinzeugen' extension. This behavior is indicative of the ransomware's file encryption process, specifically its file system traversal and modification-time sorting strategy used to prioritize recently modified files for encryption.
Detects the creation or modification of a specific log file at AppData\Roaming\DT\logs.dat on Windows systems, a known indicator of behavior associated with the Remcos Remote Access Trojan (RAT) for capturing and storing keystrokes.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
Detects the VSPMsg print processor path and DLL name, which is associated with the SprySocks malware for persistence on Windows systems. The rule looks for specific strings related to the DLL name, print processor path, and common installation directories used by this malware.
This rule detects the creation or modification of executable files (.exe) within the 'AppData\Roaming' directory, excluding common legitimate application subfolders (Microsoft, Adobe, Mozilla, Skype, Notepad++). The detection is further refined by correlating these file events with processes that have specific version information (FileDescription, OriginalFileName, or ProductName) matching 'TuglaInsaatci' or 'oacY.exe'. This pattern is indicative of potential malware or unwanted applications attempting to establish persistence or execute from user-specific application data folders.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects instances where non-browser processes access sensitive browser-related files (Login Data, Cookies, or Local State) located within AppData directories. This behavior is highly indicative of credential and session token theft, often associated with AiTM or post-compromise information harvesting activities.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
This rule identifies potential ransomware activity by detecting a process performing a high volume of file rename or modification operations within a short time window. It specifically targets files with known ransomware extensions or those using randomized 6-8 character alphanumeric extensions, while excluding common administrative, backup, and temporary file operations performed by trusted software.
Page 87 of 110