Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
Detects the creation of a scheduled task using schtasks.exe where the command line involves 'MicrosoftNodeRuntimeUpdater' and references 'node.exe' or '.js' files, specifically when initiated by script engines like node.exe, wscript.exe, or cscript.exe, while excluding known legitimate nodejs installation paths.
Detects the creation of a scheduled task using 'schtasks.exe' configured to run as the SYSTEM account for a one-time execution. This behavior is often associated with persistence mechanisms or privilege escalation attempts where an adversary seeks to execute malicious code in a high-privileged context.
Detects the creation of a Windows scheduled task configured to execute as the SYSTEM account using a one-time execution trigger. This combination is frequently used by adversaries for post-exploitation activities, such as lateral movement or persistence, as it allows for a single, immediate execution of a malicious payload with high-level privileges.
Detects the use of administrative utilities 'wmic.exe' and 'schtasks.exe' to execute commands or create scheduled tasks on remote systems, excluding local execution scenarios.
Detects the creation of a scheduled task named 'OneDriveUpdateScheduler' or the execution of a related VBScript, which are commonly used by adversaries for persistence and code execution. This rule monitors process creation events for indicators of malicious task scheduling or script execution mimicking legitimate update processes.
This rule detects the creation of a scheduled task involving 'MicrosoftIME' or the placement of an 'MicrosoftIME.exe' file within the 'Microsoft\IME' directory. It correlates these activities to identify potential persistence mechanisms where an adversary may be attempting to hijack or masquerade as a legitimate Microsoft Input Method Editor process.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
This rule monitors for a collection of adversarial behaviors on Windows systems, including persistence mechanisms via scheduled tasks and registry run keys, tampering with security services (VSS, Windows Defender), credential harvesting attempts (LSASS memory), log and history clearing, and external network communication to known IP geolocation services.
Detects the creation of scheduled tasks named after Microsoft Edge updates or the execution of suspicious Wscript commands, which may indicate persistence or execution by the LxBaseRAT malware.
This rule detects various persistence mechanisms associated with the NetSupport Manager remote access tool. It monitors for the creation of services, scheduled tasks, registry modifications (such as Run keys, Winlogon Notify packages, and keyboard filter drivers), and process executions related to NetSupport Manager (specifically client32.exe).
Detects the creation or modification of a property list (.plist) file within the /Library/LaunchAgents/ directory on macOS. The rule filters for configurations set to execute at system load, and identifies instances where the program path executed by the launch agent does not reside in standard, trusted system directories. This behavior is indicative of potential persistence mechanisms utilized by malware or unauthorized background processes.
Detects the execution of command-line tools (powershell, cmd, bash, curl, etc.) originating from common package managers and build tools (npm, node, pip, python, yarn). The rule flags these processes if they contain command-line arguments indicative of suspicious activity such as base64-encoded commands, remote script execution (IEX, curl/wget to shell), or indicators of persistence mechanisms (scheduled tasks, registry Run keys).
Detects modifications or creations of files within the /var/spool/cron directory specifically involving the postgres user, as well as process execution of the 'crontab' utility by or for the postgres user. This activity may indicate an adversary attempting to establish persistence or execute code with postgres privileges.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Page 14 of 51