Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the creation, modification, or renaming of a JSP file within the 'PSEMHUB.war' directory. This activity can indicate the deployment of a web shell or other malicious code within the PeopleSoft PSEMHUB web application, often associated with server compromise.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Detects the installation of Meow RAT persistence mechanisms on macOS by monitoring for the creation or modification of specific LaunchAgent or LaunchDaemon .plist files, particularly those named 'com.apple.accountsd.plist', and subsequent 'launchctl load' commands for these files. This rule identifies attempts to establish persistence by masquerading as legitimate system processes.
Detects the core payload components dropped by the malicious easy-day-js npm package, which is an infostealer affecting developers and CI/CD environments. The rule specifically looks for the creation or modification of 'protocal.cjs' and 'config.json' within a hidden 'NodePackages' directory located in 'C:\ProgramData\', a technique used to masquerade as legitimate Node.js tooling.
Detects modifications to the .vscode/extensions.json file which may be used by attackers to recommend malicious extensions to victims opening the workspace. Attackers can abuse this in conjunction with automated keystrokes to bypass warnings and force extension installations.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Detects the MYRA RAT (Operation Friday Harvest) establishing persistence by creating systemd user services disguised as legitimate system daemons (colord, haveged) under ~/.config/systemd/user/, enabling the service via systemctl --user enable, and dropping binaries to ~/.local/bin/. Also covers related persistence artifacts including /usr/local/lib/.libcache.so and /etc/profile.d/.sh.local. The rule also identifies node or node.exe spawning systemctl with the --user flag.
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific pattern targets the Miasma Alpine container payload.
This rule detects unauthorized access, creation, or modification of browser-specific sensitive credential files (such as 'Login Data' or 'cookies.sqlite') by processes that are not recognized web browsers or trusted update services. This behavior is a common indicator of information-stealer malware attempting to harvest session cookies and stored credentials.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects suspicious file activity indicative of Prinz Eugen ransomware. It looks for the creation of multiple files (100 or more) with the '.prinzeugen' extension and a file size of at least 1KB, which suggests encryption activity.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
Detects command-line activity indicative of timestomping, specifically when 'cmd.exe' is used with file copy/move commands ('copy', 'xcopy', 'robocopy', 'move') and the target path is not within 'Program Files' or 'Windows' directories. This behavior is often associated with ransomware like Prinz Eugen attempting to hide its activities.
This rule detects the creation or modification of executable files (.com, .exe, .scr, .pif, .bat, .cmd) in common user directories (Documents, Downloads, Desktop) where the initiating process is a legitimate application like explorer.exe, winrar.exe, or 7z.exe. This pattern is often used in phishing attacks where malicious executables are disguised as benign documents.
Detects the creation or modification of Git pre-commit hooks (.githooks/pre-commit). Contagious Interview actors use this technique to automatically execute malicious code when a target clones and interacts with a compromised repository.
This rule detects modifications to critical boot sector files (bootsect, bootmgr, BOOTCODE, MBR) on the C: or X: drives. It specifically looks for these modifications when initiated by processes other than common system processes like 'system', 'csrss.exe', or 'explorer.exe'. The rule counts modifications within one-hour bins and triggers if one or more modifications are observed.
Detects files with suspicious double extensions (e.g., .exe.txt, .dll.txt) or .scr extension, which can indicate an attempt to masquerade malicious executables or scripts as benign text files or screensavers. The rule excludes files in the System32 directory to reduce false positives.
Detects the creation or modification of VS Code tasks.json files outside of normal IDE or version control operations. Threat actors, such as North Korean groups, are weaponizing the "runOn: folderOpen" feature in tasks.json for auto-execution when a cloned repository is opened.
This rule detects the creation or modification of files within the Windows Fonts directory that use specific naming conventions (starting with 'x1', 'kx1', or 'kw1') and have no file extension or a generic one. This pattern is often associated with malware attempting to hide encrypted data containers or malicious payloads by masquerading them as legitimate system files.
Page 88 of 110