Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
87
73
22
4
4
Contributors
39
25
23
23
13
Categories
67
53
47
22
21
Platforms
124
41
12
11
8
Products / Services
31
28
24
21
17
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
3
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects behavior attributed to the AMOS (Atomic macOS Stealer) malware, where a shell process uses 'setsid' to detach from the current terminal session, followed immediately by the execution of 'killall Terminal' to conceal the execution of malicious commands.
Detects patching of network device system images for persistent backdoors
This rule detects when a GitHub workflow branch is deleted shortly after build artifacts were downloaded. This behavior can indicate an attacker attempting to hide their tracks after exfiltrating secrets or sensitive information from build artifacts. It is crucial to preserve logs and investigate who deleted the branch. Further investigation should include questioning the user about recent software installations or clicked links, and involving the security team if the answers are unclear.
This rule detects HTTP requests where the URI contains the string "/var/log/" (case-insensitive). This pattern is indicative of an attempt to access system log files directly via a web server, which could be part of an information gathering or defense evasion tactic.
Detects the use of sed commands to delete specific competitor botnet entries (e.g., mirai, gafgyt) from system persistence files like crontab or rc.local, a key defense evasion and competitor killing tactic of C0XMO.
Detects deletion of Kubernetes events in audit logs when the request completes successfully.
Adversaries may delete events to impair defenses and cover tracks (defense evasion).
Adversaries may delete events to impair defenses and cover tracks (defense evasion).
Correlation rule that counts the events produced by Kubernetes Audit Event Deletion base rule
Detects commands used to flush system kernel caches via drop_caches. In the context of the CVE-2026-31431 (CopyFail) vulnerability, flushing caches is the primary method to recover the 'su' binary after it has been corrupted by the public Proof-of-Concept exploit.
This detection identifies activity associated with the Lotus Wiper destructive malware campaign, including its orchestration scripts, staging artifacts, and destructive behaviors.
The detection focuses on:
Execution of binaries and scripts from suspicious directories (e.g., C:\lotus\)
Use of batch scripts such as OhSyncNow.bat and notesreg.bat
Deployment of auxiliary binaries (nstats.exe, nevent.exe, ndesign.exe)
System-level destructive actions including:
Disk wiping via diskpart clean all
File destruction using robocopy /MIR and fsutil file createnew
Network disruption via netsh interface disable
Account and security manipulation (e.g., disabling users, modifying CachedLogonsCount)
Service tampering (e.g., UI0Detect stop/disable)
This detection is behavior-based and designed to identify Lotus Wiper activity even when file names or paths are slightly modified.
The detection focuses on:
Execution of binaries and scripts from suspicious directories (e.g., C:\lotus\)
Use of batch scripts such as OhSyncNow.bat and notesreg.bat
Deployment of auxiliary binaries (nstats.exe, nevent.exe, ndesign.exe)
System-level destructive actions including:
Disk wiping via diskpart clean all
File destruction using robocopy /MIR and fsutil file createnew
Network disruption via netsh interface disable
Account and security manipulation (e.g., disabling users, modifying CachedLogonsCount)
Service tampering (e.g., UI0Detect stop/disable)
This detection is behavior-based and designed to identify Lotus Wiper activity even when file names or paths are slightly modified.
This is a classic Adversary-in-the-Middle (AiTM) pattern. By proxying the authentication process in real-time, the FlowerStorm-like actors are bypassing standard MFA by intercepting the session token.
The query is a triple-threat hunting as it looks for the delivery (the domain), the access (the ASNs), and the persistence/evasion (the "LinkedIn" rule) all at once.
The query is a triple-threat hunting as it looks for the delivery (the domain), the access (the ASNs), and the persistence/evasion (the "LinkedIn" rule) all at once.
Detect filter driver unloading activity via fltmc.exe
Detects when events are deleted in Kubernetes.
An adversary may delete Kubernetes events in an attempt to evade detection.
An adversary may delete Kubernetes events in an attempt to evade detection.
Detects potential malicious and unauthorized usage of bcdedit.exe
Detects possible Sysmon filter driver unloaded via fltmc.exe
Shadow Copies deletion using operating systems utilities
Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities
Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Page 5 of 10