Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects modifications to critical boot sector files (bootsect, bootmgr, BOOTCODE, MBR) on the C: or X: drives. It specifically looks for these modifications when initiated by processes other than common system processes like 'system', 'csrss.exe', or 'explorer.exe'. The rule counts modifications within one-hour bins and triggers if one or more modifications are observed.
This rule detects the creation or modification of files on a device that match a list of known malicious SHA256 hashes. It identifies potential malware presence based on file integrity.
This rule detects the creation or modification of files with specific SHA256 hashes known to be associated with adware. It monitors device file events for these hashes and logs instances where they are created or modified.
Detects malicious .config modifications suppressing ETW telemetry and bypassing strong name verification, indicative of the Screening Serpens activity. The rule specifically looks for file modifications to .config files that include specific strings related to disabling ETW and bypassing strong name verification, combined with process command line arguments containing these same strings.
This rule looks for adding a passwordless sudo rule for a CI runner account on Linux. Attackers who gain runner access can then become root freely. Remove the rule and audit runner images. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects if 'install-persistent.php' or 'class-wc-subscription-diagnostics.php' files are modified by tools like powershell.exe, certutil.exe, or cmd.exe, indicating potential alternative persistence methods or backdoor installation.
Detects the creation or modification of directories named 'logs', 'persistantstorage', or 'scratchpad' within paths related to PeopleSoft PSEMHUB. This activity could indicate an attacker staging data or setting up persistence, as observed in campaigns like ShinyHunters targeting the education sector with Oracle exploits.
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific sequence involves echoing 'runner ALL=(ALL) NOPASSWD:ALL' into a file within the /mnt/runner directory and then changing its permissions to 0440, indicative of a privileged modification to the sudoers file within a containerized GitHub Actions runner environment.
Detects attempts to overwrite web server content files for defacement
Identifies the creation or modification of unattend.xml files outside of expected deployment directories. This behavior may indicate an attempt to exploit the GreatXML zero-day vulnerability, where attackers place a crafted unattend.xml in the recovery partition to bypass BitLocker during a Windows Defender Offline Scan.
Detects command and control communications via files on removable media
Detects modifications to the VSCode tasks.json configuration file by processes other than the VSCode editor itself. This activity can indicate an attempt to establish persistence or execute malicious code, as seen with malware like Miasma which alters this file to run malicious code during local builds.
Detects a game updater overwriting an established executable in the platform directory with a new binary from a temporary staging path. This behavior can be indicative of a supply chain attack where legitimate game update mechanisms are compromised to deliver malicious payloads.
Detects local development directories where the compromised package matches a fake GitHub user repository URL, specifically looking for 'package.json' file events (creation or modification) within folder paths containing 'maximus-mcmillan'. This is indicative of the Stitch-SDK scope squatting credential harvester technique.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
This rule detects the creation or modification of files on a device that match a list of known malicious SHA256 hashes. It identifies potential malware presence based on file integrity.
Detects the staging of Miasma exfiltration payloads, specifically JSON files matching the 'results-*.json' naming convention, and Git operations interacting with these files. Miasma is known to exfiltrate harvested credentials by creating public GitHub repositories and committing encrypted JSON files with this specific naming convention.
This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.
Detects use of macOS resource forks to hide malicious data
Detects the creation or modification of 'endpointdlp.dll' and 'data.bin' files on disk, which are key indicators of the MLTBackdoor infection chain prior to DLL sideloading. This rule focuses on the initial staging of these malicious components.
Page 90 of 110