Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects attempts to overwrite critical system binaries (specifically executables in 'system32') via Server Message Block (SMB) protocol. It looks for SMB traffic to port 445, containing 'system32' and '.exe' (case-insensitive), with a payload size greater than 100,000 bytes, indicating a potential file transfer or modification of a large executable.
This rule detects network traffic that indicates a shortcut (.lnk) file is being modified or created in a 'Startup' directory, which is a common technique for establishing autostart persistence on Windows systems. The rule specifically looks for TCP traffic on port 445 (SMB) containing the strings 'Startup' and '.lnk' (case-insensitive).
This rule detects modifications to the 'com.apple.loginwindow' content over a TCP connection to port 22 (SSH). This content is associated with macOS's re-opened applications list, which can be manipulated by adversaries to establish persistence by ensuring malicious applications are launched after a user logs in or a system restarts. The detection specifically looks for the string 'com.apple.loginwindow' in the traffic, indicating an attempt to interact with or modify this critical system component.
This rule detects attempts to modify the shared library configuration file '/etc/ld.so' over an SSH connection. This activity is indicative of a shared library hijacking technique, often used for persistence or privilege escalation, where an attacker modifies the system's library loading paths to inject malicious libraries. The detection specifically looks for the string "/etc/ld.so" within TCP traffic destined for port 22 (SSH) on the home network.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
Detects replacement or hijacking of Terminal Services DLL for persistence
Detects web defacement attempts via HTTP PUT requests to web server content files
Detects the creation or execution of the SSH propagation payload script (.sshu-setup.js), used by the Hades stealer to propagate via SSH from compromised workstations. This rule identifies file creation/modification/renaming events for the specific script name, or process creation events where the command line references the script.
This rule detects potential modification of a network device's system image via TFTP. It specifically looks for UDP traffic on port 69 (TFTP) where the packet size is greater than 50000 bytes and contains the byte sequence "|00 02|" at a depth of 2 bytes, which is indicative of a TFTP write request (opcode 2). The large packet size suggests a system image transfer.
Detects the creation or modification of TieringEngineService.exe in the System32 directory, which is indicative of potential Local Privilege Escalation (LPE) via junction redirection, as observed in the RedSun exploit (CVE-2026-41091). The rule specifically excludes activities originating from the Windows WinSxS directory to reduce false positives from legitimate system updates.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
Detects the creation or modification of specific LaunchAgent plist files used by the arm64 and x86_64 variants of SStar Agent malware on macOS for persistence. The rule looks for file events (creation, modification, rename) within the /Library/LaunchAgents/ directory, specifically targeting 'com.wpnuersvc.agent.plist' and 'com.googleupdate.sstaragent.plist' filenames.
Detects the creation of CRYPTBASE.dll outside of the standard Windows system directories. This indicates an attacker staging the DLL for sideloading to exploit CWE-427 upon application execution.
This rule detects the creation or modification of the '.vscode/extensions.json' file. This file is critical for managing extensions within Visual Studio Code environments. Attackers can exploit modifications to this file, as demonstrated in recent zero-day attacks, to introduce malicious extensions, potentially leading to code execution or other forms of compromise within a developer's environment. The detection focuses on file system events (creation and modification) targeting this specific configuration file.
Detects suspicious execution or persistence artifacts in /etc/rc.d/ or /usr/local/libexec/ipsec/ on edge firewalls, specifically indicating VerdantBamboo's BRICKSTORM malware on pfSense appliances. The rule looks for process command lines or folder paths containing "/usr/local/libexec/ipsec/blacklist" or modifications to "/etc/rc.d/cron" that include "blacklist".
This rule detects attempts to modify Group Policy Objects (GPOs) over Server Message Block (SMB) by looking for HTTP PUT requests containing '\SYSVOL\' and '\Policies\' in the URI. This activity can indicate an adversary attempting to escalate privileges or establish persistence within an Active Directory domain.
This rule detects attempts to modify SSH authorized_keys files over a network connection, which could indicate an attacker establishing backdoor access. It specifically looks for the string "authorized_keys" within TCP traffic destined for port 22 (SSH).
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
Page 94 of 110