Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,503 detections
Filters
Last updated
All Time
Detection languages
8,116
7,176
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,503
11,883
5,887
5,179
4,868
Platforms
18,098
3,056
1,506
124
104
Products / Services
5,727
4,305
3,717
1,175
958
MITRE Techniques
9,495
7,578
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Detects the specific execution pattern associated with CurlRAT, where common Linux daemons (crond, atd, agetty, polkitd) perform an outbound network connection and subsequently spawn an interactive shell (sh, bash, dash) as the root user within a 5-minute window.
Detects anomalous activity originating from PostgreSQL processes, including the spawning of shells (cmd, powershell, sh, bash), access to sensitive files (e.g., /etc/shadow, SSH keys), and file creation outside the standard PostgreSQL data directories, which is consistent with the abuse of SQL functionality like pg_read_file() or lo_export().
Detects anomalous activity originating from PostgreSQL processes, including the spawning of shells (cmd, powershell, sh, bash), access to sensitive files (e.g., /etc/shadow, SSH keys), and file creation outside the standard PostgreSQL data directories, which is consistent with the abuse of SQL functionality like pg_read_file() or lo_export().
Detects anomalous activity originating from PostgreSQL processes, including the spawning of shells (cmd, powershell, sh, bash), access to sensitive files (e.g., /etc/shadow, SSH keys), and file creation outside the standard PostgreSQL data directories, which is consistent with the abuse of SQL functionality like pg_read_file() or lo_export().
This rule detects activities related to Tampermonkey (a popular browser extension for userscripts) or interactions with paste.sh, often used for hosting scripts or payloads. The rule monitors both process-level executions and network requests for these indicators, which may be associated with malicious script execution or browser-based credential or session theft.
Detects execution of 'BrowserCore.exe' when the initiating (parent) process is not a recognized web browser (msedge.exe, chrome.exe, or firefox.exe). This rule flags potential process masquerading or misuse of the BrowserCore utility, particularly when spawned by command interpreters or the Task Scheduler.
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
Detects the execution of package managers (pip or npm) to install software dependencies initiated by development or agent-related processes (like IDEs or background services) in a non-interactive session. This behavior can be indicative of automated dependency confusion attacks, malicious supply chain activity, or unauthorized package installation occurring without direct user oversight.
Detects the execution of package managers (pip or npm) to install software dependencies initiated by development or agent-related processes (like IDEs or background services) in a non-interactive session. This behavior can be indicative of automated dependency confusion attacks, malicious supply chain activity, or unauthorized package installation occurring without direct user oversight.
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
Detects the execution of package managers (pip or npm) to install software dependencies initiated by development or agent-related processes (like IDEs or background services) in a non-interactive session. This behavior can be indicative of automated dependency confusion attacks, malicious supply chain activity, or unauthorized package installation occurring without direct user oversight.
Detects package manager processes (npm, pip, python) executing install-related commands followed by the creation or modification of sensitive files (SSH keys, cloud credentials, shell configurations) within a short timeframe. This behavior is indicative of potential supply chain attacks where a malicious package attempts to steal credentials or secrets upon installation.
Detects package manager processes (npm, pip, python) executing install-related commands followed by the creation or modification of sensitive files (SSH keys, cloud credentials, shell configurations) within a short timeframe. This behavior is indicative of potential supply chain attacks where a malicious package attempts to steal credentials or secrets upon installation.
Detects package manager processes (npm, pip, python) executing install-related commands followed by the creation or modification of sensitive files (SSH keys, cloud credentials, shell configurations) within a short timeframe. This behavior is indicative of potential supply chain attacks where a malicious package attempts to steal credentials or secrets upon installation.
Detects package manager processes (npm, pip, python) executing install-related commands followed by the creation or modification of sensitive files (SSH keys, cloud credentials, shell configurations) within a short timeframe. This behavior is indicative of potential supply chain attacks where a malicious package attempts to steal credentials or secrets upon installation.
Page 273 of 977