Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects modification of Linux RC initialization scripts for persistent execution
Detects modification of LNK shortcut files in startup folders for autostart persistence
Detects the creation or modification of a VSCode package.json file that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting the 'skipPublisherTrust' flag to true. This technique can be used by adversaries to install malicious VSCode extensions without publisher trust checks, potentially leading to supply chain compromise or defense evasion.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
This rule detects the staging (creation, modification, or renaming) and subsequent execution of executable files (.exe) within the 'C:\Users\Public\Music\' directory. This folder is an unusual location for executables and is often leveraged by adversaries for staging malicious payloads to evade detection. The rule specifically references 'Grixba' and 'Play Ransomware' in its context, suggesting it targets behaviors associated with these threats.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
Detects Hero proxyware artifacts being written or modified within the Windows SysWOW64 directory. Presence of these files may indicate installation of unauthorized proxy services or abuse of enterprise endpoints for traffic relaying.
This rule detects network traffic containing the string "/etc/sudoers" over TCP port 22 (SSH). This could indicate an attempt to modify the sudoers file for privilege escalation, as the sudoers file controls which users can execute commands with superuser privileges.
This rule detects attempts to modify login scripts, specifically '.profile', on a remote host via SSH. The detection is based on observing the string ".profile" within TCP traffic destined for port 22 (SSH) on the home network. This activity could indicate an attacker establishing persistence by modifying user login scripts to execute malicious commands upon subsequent logins.
This rule detects attempts to deface a web server's homepage by replacing its content. It specifically looks for HTTP PUT requests targeting a URI containing "index" (case-insensitive), indicating an attempt to modify an index file. The rule also checks the size of the data being sent in the PUT request, looking for a size between 500 and 5000 bytes, which could indicate the insertion of defacement content.
This rule detects attempts to deface web server content by using an HTTP PUT request to modify files with extensions such as .html, .htm, .php, .asp, or .aspx. It specifically looks for HTTP PUT methods targeting these file types on an internal web server.
This rule detects attempts to move executable files (.exe) over SMB (Server Message Block) by looking for the 'MoveFile' string and the '.exe' extension in network traffic on port 445. This activity could indicate malware being relocated on a network share.
Detects the creation or renaming of files to append the .nspire extension, a direct indicator of NightSpire ransomware encryption activity.
This rule detects the creation or modification of files with specific SHA256 hashes known to be associated with adware. It monitors device file events for these hashes and logs instances where they are created or modified.
This rule detects attempts to modify file timestamps over SMB. Specifically, it looks for the 'SetFileTime' operation within SMB traffic on port 445. This activity can be indicative of an adversary attempting to hide their presence or activities by making malicious files appear to have legitimate creation or modification times, a technique known as timestomping.
This rule detects attempts to modify the macOS Transparency, Consent, and Control (TCC) database over an SSH connection. The TCC database stores user privacy settings, and its modification can indicate an attempt to bypass security controls or escalate privileges. The rule specifically looks for the string "TCC.db" within TCP traffic directed to port 22 (SSH).
This rule detects attempts to add an SSH key to a server's authorized_keys file via a web shell. It specifically looks for HTTP POST requests where the URI content includes "authorized_keys". This activity is indicative of an attacker establishing persistence on a compromised server by adding their SSH key for future unauthorized access.
This rule detects network traffic containing the string "/etc/rc" over SSH (port 22) to a server within the home network. This pattern suggests an attempt to modify an RC script for persistence on a Linux system, potentially by an attacker who has gained SSH access.
This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.
This rule detects modifications to macOS Login Hook scripts via SSH. Login Hooks are scripts that execute when a user logs in or out, and their modification can be an indicator of persistence mechanisms used by attackers. The rule specifically looks for TCP traffic on port 22 (SSH) containing the string 'LoginHook' in a case-insensitive manner, indicating an attempt to interact with or modify these scripts.
Page 93 of 110