Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,459
11,842
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints,
indicative of credential harvesting by the Mini Shai-Hulud malware.
indicative of credential harvesting by the Mini Shai-Hulud malware.
Detects potentially malicious SMB activity associated with GhostLock-style
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
POW Proxy-over-Web Custom HTTP Headers
Cortex XDR
Detects HTTP traffic containing the custom POST headers used by the SHADOW-AETHER-064 'POW' (Proxy over Web) tool to encapsulate SOCKS5 traffic inside HTTP requests forwarded through JSP webshells. The full header set per Trend Micro's analysis is X-Act, X-Sid, X-Host, X-Port, and X-Status. The X-Act header carries one of five specific command values (CONNECT, SEND, RECV, DISCONNECT, PING) which provides an additional fidelity boost. The combination of two or more of these headers in a single HTTP transaction is exclusive to the POW tool.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects execution of Python with PySoxy SOCKS5 proxy arguments (-ssl, -remote_port, -remote_ip) alongside compiled bytecode (.pyc) execution. PySoxy is a 10-year-old open-source SOCKS5 proxy that ReliaQuest observed being deployed via ClickFix as a secondary encrypted access path alongside PowerShell-based C2. The specific combination of these three argument flags with .pyc execution is rare in legitimate use and represents the PySoxy invocation pattern verbatim.
This rule detects a potential privilege escalation attempt on Linux systems. It looks for two main indicators: first, the execution of the 'su' command from a user's home directory by a process whose executable was recently created in a user's home directory and identified as an ELF binary. Second, it identifies systems where public-facing network connections were made by processes using common remote file transfer utilities (curl, wget, lftp, axel, aria2, scp, rsync, ftp) to fetch code, followed by the execution of a process with 'algif-aead' in its command line, which could indicate fileless execution after remote code fetching. The combination suggests an attacker might be fetching malicious code, potentially compiling it, and then using it to escalate privileges via 'su' or executing it filelessly.
Detects instances where 'curl.exe' is used to download content related to Node.js, specifically looking for 'nodejs.org' or 'node-v' in the command line. This could indicate an adversary attempting to download and execute a Node.js runtime or related tools on a compromised system.
Detects behavioral characteristics of the Needle Rust desktop agent: an unsigned Rust PE in the 5-50MB range, executing from user-writable paths, and establishing the Run-key persistence the agent installs at HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Rust panic-handler source paths (src/views/zelcore/app.rs, src/views/trezor/seed_panel.rs, src/views/ledger/screens/seed_recovery.rs) are also surfaced via the binary's data section and are extremely high-fidelity if visible in any command-line or memory-scan telemetry. This rule pairs the persistence registration with the agent execution context.
Detects network connections to known REF6598 staging and command-and-control infrastructure, including a hardcoded staging IP and PHANTOMPULSE panel domains. This provides a high-fidelity signal of active PHANTOMPULSE infections and potential data exfiltration attempts.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints, indicative of credential harvesting.
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
Detects the malformed User-Agent string used by CL-STA-1132 during exploitation
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
CL-STA-1132 Specific User-Agent
Cortex XDR
Detects network traffic utilizing the highly specific and anomalous User-Agent string used by CL-STA-1132 during the exploitation and post-exploitation of CVE-2026-0300.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP addresses). This rule identifies communication with specific malicious domains and IP addresses associated with the PhantomRaven campaign, indicating potential compromise or attempted communication with adversary infrastructure.
Detects Node.js processes querying public IP-address and geolocation lookup services. This automated reconnaissance behavior is the standard "where am I" primitive used by an enormous range of Node-based malware and supply chain campaigns including PhantomRaven (npm), Shai-Hulud, the Bitwarden CLI compromise, Ultralytics-style attacks, and countless commodity Node-based stealers and droppers. Legitimate Node applications rarely query public IP services from developer endpoints — when they do, it is most often during malicious package install lifecycle hooks or within fileless droppers fetched from attacker-controlled C2 servers.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP). This rule specifically looks for connections to 'pack.nppacks.com', 'hblnew.ecompk.com', or the IP address '54.160.138.70'.
Page 180 of 246