Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects the creation or modification of large Zstandard (.zst or .tar.zst) archive files (100MB or larger) within common temporary, data exfiltration, staging, or PeopleSoft-related directories. This activity can indicate an attacker archiving collected data for exfiltration or staging it for further actions.
Detects modifications to the .bashrc file by unexpected scripts (node, python). Miasma uses this to ensure payloads run every time a user opens a new terminal.
Detects the creation or modification of a 'setup.mjs' file within a '.vscode' directory. This script can act as a local payload execution point when developers open infected projects, potentially leading to arbitrary code execution.
Detects modification of the Magefile or related integrity markers inside the ClickOnce cache, a technique used to alter payloads post-deployment.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects creation, modification, or renaming of 'help.php' within a REDCap application path. This activity is indicative of a web shell deployment, as observed by GTIG with UNC6508 using 'help.php' for persistence and payload uploads. The combination of the campaign-specific filename and REDCap path provides a high-confidence signal.
This rule correlates the modification of 'Upgrade.php' with subsequent changes to REDCap authentication, login, or hook-related PHP files on the same device within a 30-minute window. This activity is indicative of the INFINITERED threat actor's technique to intercept the REDCap upgrade process and reinject credential harvesting, backdoor, and persistence code into new software versions. Such a sequence should be compared with approved maintenance windows and expected deployment activity to identify malicious behavior.
Detects modification of Group Policy Objects for privilege escalation
Detects the creation, modification, or renaming of the 'com.finder.helper.plist' file in the '/Library/LaunchDaemons/' directory, which is a specific persistence mechanism used by the AMOS stealer malware. This rule specifically targets the root-level persistence method.
Detects the creation or modification of a local VSCode workspace extension (package.json) that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting 'skipPublisherTrust' to true. This technique is used to bypass VSCode's publisher trust mechanisms and silently install malicious extensions.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
This rule detects the presence of specific files and API calls associated with the SprySocks malware, which functions as a keylogger. It looks for 'lgf.dat' and 'lg.dat' files within a 'Microsoft\Vault' directory, combined with the presence of keylogging-related API functions like 'GetClipboardData', 'GetForegroundWindow', and 'GetAsyncKeyState'. This combination indicates potential keylogger activity on a Windows system.
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects modification of macOS plist files to hide processes or enable autostart
Detects the use of 'chattr +i' to make files immutable. This technique is used by malware, such as Miasma payloads, to prevent security tools and administrators from deleting malicious artifacts, hindering incident response and forensic analysis.
Detects when scripting language interpreters (Node, Python, Bun, NPM) create or modify files within the '/etc/cron.d/' directory. This activity is suspicious as it may indicate a compromised package or malicious actor attempting to establish system-wide persistence via scheduled tasks.
Detects non-standard scripts altering the authorized_keys file to inject attacker SSH public keys, providing persistent backdoor access to the compromised machine. Specifically looks for modifications or creations of 'authorized_keys' files by 'node', 'python', or 'bun' processes.
Detects an attacker disabling Code Access Security (CAS) publisher validation by modifying a .NET .config file, specifically looking for modifications to files ending with '.config' in conjunction with a process command line containing 'generatePublisherEvidence'.
Detects the creation, renaming, or modification of 'vcpktsvr.exe' and 'libcef.dll' within a directory path containing '\vcpacket'. The rule specifically looks for the co-occurrence of both files within a 10-minute window on the same device, indicating the presence of the Windows ZiChatBot malware stage, which is known to use DLL side-loading.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
Page 89 of 110