Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
203 detections
Filters
Last updated
All Time
Detection languages
76
72
13
12
8
Contributors
34
27
25
20
18
Categories
89
65
45
23
22
Platforms
173
30
21
6
3
Products / Services
42
40
26
7
5
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
5
1
1
1
IDS Classtypes
4
3
IDS Protocols
4
2
1
This rule detects suspicious directory creation or file attribute modifications within the 'naverwhale' roaming AppData directory. Adversaries may use this path to stage malicious payloads, persistence mechanisms, or to impersonate legitimate browser files.
Detects execution of mass file-deletion or system wipe commands triggered by processes running from known persistence or staging locations associated with the CHOSEN BRICK campaign. The rule monitors for the combination of suspicious process paths (such as disguised winappx.exe or SysWOW64-lookalike directories) and destructive command-line arguments like 'del', 'cipher', 'format', or 'vssadmin' operations.
Detects a Node.js process executing a JavaScript file that spawns a secondary Node.js child process, followed immediately by the creation or modification of Windows Run registry keys for persistence. This sequence is indicative of malicious npm package activity where a secondary, hidden payload is downloaded and configured to execute upon system startup.
This rule detects the presence or execution of known files 'winfsp-x64.dll' or 'DukeQt.dll' when located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, while excluding standard system or program installation paths.
Detects instances where processes associated with Claude or Codex modify or create files within a plugin directory without a preceding legitimate installation or session command (such as 'install' or 'plugin add'). This behavior may indicate unauthorized plugin installation, persistence establishment, or malicious code injection into the development environment.
This rule detects the execution of specific suspicious binary names or processes loading a specific DLL from locations outside of the legitimate Windows System32 or SysWOW64 directories. This behavior is indicative of potentially malicious executables or side-loaded DLLs masquerading as system components or running from non-standard locations to evade detection.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
Detects execution or file presence associated with the TraderTraitor malware, specifically targeting known malicious file paths or SHA1 hashes used by the actor to masquerade as legitimate macOS system utilities (iTunesCloud, iSync, AppleAccountd).
Detects execution or file presence associated with the TraderTraitor malware, specifically targeting known malicious file paths or SHA1 hashes used by the actor to masquerade as legitimate macOS system utilities (iTunesCloud, iSync, AppleAccountd).
Detects execution or file presence associated with the TraderTraitor malware, specifically targeting known malicious file paths or SHA1 hashes used by the actor to masquerade as legitimate macOS system utilities (iTunesCloud, iSync, AppleAccountd).
Detects the creation of a hidden file named '.Outlook' within the user's AppData Roaming directory. This behavior is atypical for standard Outlook operations and may indicate malicious activity, such as configuration tampering, persistence mechanisms, or data staging by malware.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
Detects the creation or renaming of specific files ('windowSysUpdates.txt' or 'GymTraniningShedule.exe') within the user's Local AppData directory or its 'SystemFolder32'/'System Folder32' subdirectories. This behavior is indicative of potential malicious activity, such as staged malware persistence or disguised payloads.
Detects persistence mechanisms used by a Golang RAT, specifically targeting the creation of a 'DailyFitnessTracker' registry value in the HKCU Run key using reg.exe or PowerShell, and the placement of 'FitnessMonitor.exe' into the Windows Startup folder.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
This rule detects either the execution of a specific SSH daemon binary known to be trojanized or the creation/modification of files within the /var/lib/sshd/ directory, which is a common indicator of backdoor persistence or credential theft targeting SSH sessions.
Detects indicators of the MovieReaper loader, specifically the downloading of shellcode fragments disguised as image assets from known malicious C2 infrastructure, and the masquerading of a malicious binary as 'msedge.exe' within the Windows Telemetry folder for persistence. The rule specifically targets the loader's behavior of using PEB Ldr traversal to resolve APIs and evade hooking-based security controls.
This rule detects potential persistence mechanisms in a PostgreSQL database by identifying the creation of a new shared library file (e.g., .so or .dll) within PostgreSQL plugin directories, followed by a modification to the PostgreSQL configuration files (postgresql.conf or postgresql.auto.conf) within a short 30-minute window. This behavior is indicative of an attacker registering a malicious shared library to be loaded upon database startup, a technique associated with PostGREShell-style post-exploitation.
Detects file creation, modification, or renaming in System32 by TieringEngineService.exe or MsMpEng.exe within a short time frame.
Page 2 of 10