Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects curl reusing a captured cookie jar (-b /tmp/lhr_c) against a known tunnel domain, indicating session-cookie replay to hijack an authenticated session exposed via a reverse tunnel.
This rule detects the use of the Windows native utility 'wbadmin.exe' to delete the backup catalog. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing the ability to restore data from built-in Windows backup utilities.
Detects instances where AI coding assistants (e.g., Cursor, Claude, Copilot) are observed interacting with specific configuration or sensitive files and subsequently initiating suspicious shell commands. The rule correlates file read activity (containing keywords like 'skill', 'preflight', '.ssh', or '.aws') followed closely by execution of potentially malicious commands like 'whoami /priv', credential decoding, or registry exploration, indicating potential abuse of the assistant's context.
This rule detects suspicious activity involving the modification of file attributes on macOS, specifically targeting the removal of the 'com.apple.quarantine' extended attribute and the manipulation of files associated with 'com.apple.trustd'. Such actions are indicative of an adversary attempting to bypass Gatekeeper security controls or execute masqueraded payloads by stripping quarantine flags or modifying execution permissions.
No description available.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
Detects curl liveness/health-check requests against a known tunnel domain issued repeatedly from a loop construct or a LaunchAgent/watchdog parent, indicating an automated watchdog keeping a reverse tunnel alive.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
Detects potential memory scraping or credential dumping attempts targeting the Google Chrome process (chrome.exe). The rule monitors for command-line arguments involving known dump utilities ('MiniDump', 'procdump', 'rundll32') or the use of 'comsvcs.dll', which is commonly used to dump process memory, specifically when targeted against a browser process.
This rule detects suspicious process execution chains where common web application servers (gunicorn, uwsgi, celery) spawn command-line utilities (bash, sh, curl, wget, python3) containing strings indicative of Python object inspection or class pollution. This pattern is commonly associated with attempts to exploit server-side vulnerabilities for remote code execution or post-exploitation activities.
This rule detects potentially malicious child processes spawned by LOLBins (Living Off the Land Binaries) like mshta.exe, wscript.exe, cscript.exe, rundll32.exe, or regsvr32.exe, which were themselves initiated by document applications (e.g., Office, Acrobat) or common shell interpreters. It specifically identifies downstream payloads that are either unsigned or signed by non-trusted publishers, filtering out Microsoft and common third-party software signers.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
Detects execution of potentially malicious JavaScript files (e.g., setup.mjs, math_init.js) via Node.js or Bun command-line tools. This often indicates the execution of obfuscated or unauthorized scripts during software installation or supply chain compromise attempts.
This rule detects potentially malicious activity associated with known supply chain compromise indicators in npm packages (such as Keyv and associated malicious scripts). It flags the execution of specific suspicious files (e.g., 'setup.mjs', 'Math_Symbol.js') or the use of specific versions of common packages known to be associated with recent supply chain attacks, when executed via npm or node.js runtime.
This rule detects potential persistence attempts on macOS by monitoring 'launchctl' commands used to bootstrap LaunchAgents or modify configuration files related to Apple's software update mechanisms. It also flags file events involving the 'com.apple.softwareupdate' cache directory, which could indicate an adversary attempting to stage or replace update-related files.
Detects su-privileged execution of an embedded ELF payload (libdevice.so or the disguised com.n2.systemservice package) from an application-data directory, consistent with the Kimwolf v7 Android dropper establishing persistence outside standard system binary paths.
Detects a shell/interpreter process spawned by a VS Code / VS Code-Insiders editor process that references CI marker environment variable names (GITHUB_, GITHUB_REPOSITORY, GITLAB_CI_, CI_PROJECT_PATH), matching how malicious Open VSX 'evil twin' extensions harvested CI/CD environment variables from GitHub, GitLab, and Azure DevOps runners.
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects pgrep searching for ngrok, cloudflared, or wireguard-go process names from within a Claude Code shell-snapshot session, indicating discovery of tunnel/VPN tooling as part of an agent-driven attack chain.
Detects cloudflared launched with 'tunnel --url' against localhost or api.trycloudflare.com without managed-tunnel authentication flags, indicating deployment of an ad-hoc Cloudflare Quick Tunnel exposing a local service to the internet.
Page 297 of 977