Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,583 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
476
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,444
1,825
1,661
1,578
1,416
Platforms
8,040
1,889
1,334
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
Detects modification or creation of .htaccess files within WordPress directory structures followed within 24 hours by the creation or modification of .cache files in the same directory. This behavioral pattern is often indicative of web shell deployment or persistence installation via compromised web applications.
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Detects web server processes writing PHP files into sensitive WordPress directories (such as mu-plugins or rank-math-pro/includes) shortly after deleting them within a 1-hour window. This behavior often indicates the rebuilding or updating of a webshell or backdoor for persistence.
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects a root SSH sign-in from a public IP address or known attacker IP, followed within 30 minutes by a write or modification to the root authorized_keys file on the same device.
Detects web server processes (such as apache2, nginx, httpd, php-fpm, or w3wp.exe) spawning shell interpreters (such as bash, sh, cmd.exe, or powershell.exe), which is a common indicator of web shell activity or application exploitation.
Detects potential cryptocurrency clipper malware by monitoring the staging of multiple attacker wallet addresses (BTC, ETH, TRC) under the HKCU\Software\Clipper registry path by a non-system process.
Detects the creation of a scheduled task named ChromeUpdate with highest privileges on logon, initiated from a process running within the user AppData\Local\Temp directory.
Detects when a process modifies the Windows Registry to disable zone checks (SEE_MASK_NOZONECHECKS) in the Environment key and alters settings to show hidden files (ShowSuerHidden) within 30 minutes on the same device. This behavior is commonly associated with malware attempting to execute downloaded payloads without security prompts while concealing artifacts.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects operator synchronization scripts (sync-all.sh, sync-memory.sh, sync-cc-users.sh) spawning SSH, rsync, or scp commands targeting AI-named jump-server accounts (claude, grok, gemini, glm).
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Box Shield Suspicious Location Access
Cortex XDR
Surfaces Box Shield suspicious location alerts with geographic context and accessed content details. Detects access from unusual or excluded geographic locations indicating potential compromised accounts or credential theft.
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects sign-in events to Entra ID via service principals where the application is marked as external and enabled, and the user agent string indicates the use of a Python client.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects instances where inst.exe running from C:\ProgramData\Intel with specific command-line arguments (extensionless and key-like) subsequently writes files to the EFI system partition or boot paths on the same device.
Correlates the modification of the Explorer Policies Run registry key (specifically the 'Loader' value) with the creation or modification of a .url shortcut file in the user Startup folder on the same device within a 1-hour window, using the same initiating process.
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Page 3 of 600