Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects potential information stealer activity by identifying the staging of files (.html, .txt, .log) in common user directories like AppData or Temp, combined with process command lines querying sensitive system information (e.g., BIOS, wallets, screen resolution) and network connections to the Telegram API for likely exfiltration.
Detects attempts to bypass macOS Gatekeeper security controls by either removing the quarantine extended attribute or marking a file as executable using 'xattr' or 'chmod'. These techniques are used to allow untrusted or malicious applications to execute without user authorization.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects high volumes of file creations, modifications, or renames ending with a specific encrypted file extension (.df_win) occurring across multiple network (SMB) shares from a single host within a short timeframe. This behavior is indicative of ransomware activity where a compromised host attempts to encrypt files on accessible remote storage.
Detects potential abuse of rundll32.exe to execute commands or functions, particularly those involving references to 'WindowsUpdate.log' or direct execution with ordinal identifiers ('#1'). This rule also monitors file operations involving 'WindowsUpdate.log' initiated by common script interpreters like powershell.exe, cmd.exe, or rundll32.exe, which is often associated with obfuscated techniques to execute malicious payloads or bypass security controls.
Detects malicious PHP web shell patterns (e.g., base64_decode, system, eval, passthru) within the WordPress plugins directory. This often indicates the presence of a trojanized plugin update or unauthorized file modification following a supply chain compromise.
Detects obfuscated PHP code within the Admin Menu Editor Pro plugin, specifically targeting indicators associated with the supply chain compromise of versions 2.35 and 2.36. The rule searches for common PHP execution functions used in web shells within the context of the vulnerable plugin directory.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects the presence of specific versions (2.35 and 2.36) of the Admin Menu Editor Pro WordPress plugin, which were reported to be distributed as trojanized versions via a compromised update infrastructure.
Detects the modification of a GitHub Actions release workflow that removes manual approval/gate requirements and introduces a push-to-main trigger, followed closely by an automated npm publish event. This behavior suggests an attempt to establish an unattended supply chain release path.
Detects multiple rapid modifications to GitHub Actions workflow files (.github/workflows/*.yaml) within a short timeframe (<= 20 minutes). This pattern is indicative of potential CI/CD pipeline poisoning or suspicious activity where an actor may be attempting to inject malicious code or configurations into the build process.
Detects unauthorized modifications to GitHub Actions workflow configuration files (.github/workflows/*.yml) that explicitly enable automated publishing triggers (push to main branch). The rule looks for specific content patterns in the workflow file indicating a push-to-main trigger and monitors for suspicious or known bad commit hashes associated with such changes.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
This rule detects the installation or presence of ten identified malicious npm packages associated with the indexed-btree/sorted-btree typosquatting campaign. It monitors command-line activity for 'npm install' commands, package name resolution, and entries within 'package.json' files.
Detects modifications to the /etc/sudoers or /etc/sudoers.d configuration files by non-root users. This activity is often associated with privilege escalation attempts where an adversary attempts to modify sudo policies to grant themselves elevated permissions or bypass password requirements.
Page 23 of 109