Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This detection identifies suspicious child process execution spawned from Notepad++ (notepad++.exe), which may indicate exploitation attempts related to CVE-2026-48778 and CVE-2026-48800. These vulnerabilities involve potential arbitrary code execution through malicious manipulation of Notepad++ configuration (config.xml) and shortcut (shortcuts.xml) files.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
Detects the creation or modification of YTSysConfig.ini or YTSysConfig.ytf, which are runtime configuration files for the ClientSetup/Yangtu payload used in the TAX#TRIDENT campaign. This activity indicates potential deployment or configuration of the malware.
Detects the creation or modification of the specific malware debug log file 'lua_traceback.log' in the C:\temp directory, which is a unique artifact of the BoldTealLayer loader.
Detects suspicious modifications to Notepad++ configuration files (config.xml or shortcuts.xml) by processes other than Notepad++ itself. This behavior may indicate an attempt to exploit vulnerabilities (e.g., CVE-2026-48778 or CVE-2026-48800) by injecting unvalidated interpreter commands, leading to arbitrary code execution or other malicious activities.
Detects the creation or modification of specific LaunchAgent plist files used by JINX-0164's AUDIOFIX and MINIRAT malware for persistence on macOS. The rule monitors for file creation, renaming, or modification events within the /Library/LaunchAgents/ directory, specifically targeting plist files with names known to be used by this malware.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
KQL Query
KQL Query
This rule detects modifications, creations, or renames of the Google Chrome 'Secure Preferences' file on macOS. This activity can be indicative of malware, such as FlutterShell, attempting to alter browser settings or inject malicious configurations for persistence or other malicious purposes.
This detection identifies the use of the chattr command on Linux endpoints to add or remove the immutable (+i/-i) attribute on files. Threat actors abuse this technique to protect malicious files (such as persistence mechanisms or web shells) from modification or deletion, or to remove immutability from system files prior to tampering. Investigate the parent process, executing user, and target file path to determine whether the activity aligns with legitimate administrative work or indicates anti-forensics or persistence behavior.
Detects modifications to /home/vmanage-admin/.ssh/authorized_keys on Cisco SD-WAN controllers (vSmart, vManage, vBond) by any process. This file is a post-exploitation persistence target documented by Resecurity and Rapid7 for CVE-2026-20182. Legitimate modifications to this file are extremely rare in production SD-WAN deployments, as the vmanage-admin account is an internal service account and its authorized_keys file is provisioned during initial deployment and rarely touched afterward. Any write event is worth immediate investigation.
Detects file creation, modification, or renaming events in the suspicious '%AppData%\WinDataScope' directory. This directory is hardcoded in the FrostyNeighbor dropper for staging PicassoLoader, indicating potential malware activity.
Linux Timestomping via Reference FIle
Cortex XDR
Detects the use of the 'touch' command on Linux with '-m' and '-r' (reference file) or '--reference' arguments. This combination can be used for timestomping, a technique to modify file timestamps to evade detection or forensic analysis by making malicious files appear to have legitimate creation/modification times.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects the creation of files indicative of the compromised Checkmarx AST plugin version 2026.5.09 being deployed. This rule identifies specific malicious filenames or known compromised SHA256 hashes associated with the TeamPCP backdoor.
Page 96 of 110