Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where processes associated with Claude AI (e.g., node, shell) spawn suspicious child processes such as Python interpreters, pip package managers, or shell scripts (sh, bash) with command-line arguments indicative of AI-driven project initiation, package installation, or automated setup tasks. This pattern is characteristic of AI-based agents executing code or performing automation on a developer workstation.
Detects suspicious command execution patterns, including reverse shell techniques (/dev/tcp, bash -i), DNS-based C2 communication (axiom-config, m100.cloud), and fileless payload retrieval (dig TXT queries). It specifically highlights commands initiated by common AI developer tools or runtimes (claude, node, python) that correlate with known adversarial setup scripts or potential prompt injection outcomes.
This rule detects potential Mythic C2 implant or payload build activity occurring via Docker. It monitors for executions of docker.exe, docker-compose.exe, or docker commands initiated by shells (cmd.exe, powershell.exe) containing keywords associated with the Mythic C2 framework, while explicitly excluding common CI/CD runner parent processes to reduce noise.
This rule detects potentially suspicious process executions originating from the Amazon Q language server or related processes. It monitors for commands involving MCP configuration files, AWS STS identity verification, and generic HTTP POST requests, which may indicate unauthorized activity or credential/configuration harvesting.
Detects outbound network connections to common Mythic C2 ports initiated by processes identified as compiler-related binaries (Go, Zig, Rust) or binaries running from suspicious, user-writable directories (Temp, AppData, etc.). This behavior is consistent with the execution of staging or initial implants associated with the Mythic post-exploitation framework.
Detects the execution of the 'unshare' utility on Linux systems using command-line arguments that indicate the creation of new namespaces, particularly targeting user and network namespace isolation. Adversaries often use 'unshare' to bypass security controls or to facilitate container escapes by isolating processes from the host's environment.
This rule detects the use of specific Linux utilities often associated with local privilege escalation or container escape techniques. It monitors for commands involving 'unshare' with flags that allow user or network namespace manipulation, network traffic control ('tc') commands specifically interacting with 'pedit' or 'qdisc' which can be abused for kernel-level manipulation, 'ip netns' commands to manage network namespaces, and execution of known exploit-related filenames like 'pedit_cow_demo' or 'packet_edit_meme'.
Detects the execution of a malicious PowerShell loader associated with the UAC-0226 threat actor. The loader employs a 60-second sleep delay using the Start-Sleep cmdlet to evade automated sandbox analysis before proceeding to reflectively load the GIFTEDCROOK payload from a file located in C:\ProgramData\WC3.
Detects non-root users utilizing the 'tc' or 'ip' utilities to interact with kernel traffic control structures (qdisc/filter/action) specifically involving 'pedit' actions. This activity is a documented prerequisite for exploiting CVE-2026-46331, a vulnerability enabling page cache poisoning and local privilege escalation.
Detects the KuinaExtractor UAC bypass technique, which exploits the auto-elevated 'SilentCleanup' scheduled task. The rule identifies suspicious activity via two patterns: the execution of 'cleanmgr.exe' from an unexpected parent process (bypassing normal task scheduler invocation) or the explicit execution of 'schtasks.exe' to trigger the 'SilentCleanup' task.
Detects the use of System.Reflection.Emit.DynamicMethod and ILGenerator in PowerShell 7 scripts to perform an AMSI bypass. The attack works by emitting IL opcodes to directly modify the internal 's_amsiInitFailed' field within the AmsiUtils class, bypassing the initonly constraint to disable AMSI scanning.
Detects attempts to disable or impair Microsoft Defender Antivirus using legitimate system administration tools such as PowerShell (Set-MpPreference, Add-MpPreference), WMIC, sc.exe, or net.exe. Adversaries may use these tools to bypass security controls by disabling real-time monitoring or adding unauthorized exclusion paths.
Detects the resolution of DNS TXT records using dig, followed by piping the decoded base64 output directly to bash for execution. This technique is characteristic of fileless payload delivery and remote command execution, specifically observed in the Axiom indirect prompt injection attack chain.
Detects malicious execution patterns during npm package installation consistent with Miasma and Mini Shai-Hulud supply chain attacks. The rule monitors for node.exe or bun.exe being spawned by npm or node-gyp that exhibit suspicious behavior, such as accessing sensitive credential paths (e.g., .ssh, .npmrc, .gitconfig) or utilizing a Phantom Gyp execution pattern where index.js is executed directly within node_modules via node-gyp, as well as bun.exe staging execution from temporary directories.
Detects the creation of user namespaces combined with network namespace flags using 'unshare' or 'ip netns' by non-root users. This activity is a necessary precursor for exploiting the CVE-2026-46331 vulnerability (pedit COW) to gain CAP_NET_ADMIN capabilities and subsequently corrupt the Linux page cache.
Detects the Miasma malware attempting to enumerate installed developer and AI coding tools by executing version-check or help commands. The rule monitors for a pattern of 5 or more child process executions from 'node.exe' or 'bun.exe' within a 30-second window, which targets tools like VS Code, Cursor, Claude, AWS CLI, kubectl, helm, npm, git, and docker.
Detects unauthorized HTTPS POST requests to sensitive GitHub API endpoints (gists, repository contents, user emails) originating from standard command-line tools like curl, node, and PowerShell. Additionally, it identifies suspicious git push operations initiated from within node-based installation scripts, which is indicative of credential harvesting and exfiltration behaviors exhibited by the Miasma worm.
Detects the self-deletion mechanism used by the TinyRCT backdoor, which employs a timed delay loop using either 'choice.exe' or 'ping.exe' before executing a file deletion command ('del' or 'erase') to remove its own executable from the system. This behavior is indicative of a malware cleanup routine designed to erase traces of its presence after activity has concluded.
Detects the use of WinRAR or rar.exe to archive sensitive web directory content (e.g., wwwroot, web.config, database files) when spawned from web server processes like w3wp.exe or cmd.exe. This behavior is indicative of data staging for exfiltration, a common tactic for actors like those associated with the CL-STA-1062 intrusion campaign.
This rule detects the execution of script files (.vbs, .ps1, .hta, .lnk, .exe) from potential removable media drives (drive letters D-Z) by common Windows interpreters (wscript.exe, cscript.exe, powershell.exe). It monitors for these processes being launched either as standalone processes or as children of other scripts, explorer.exe, or interpreters, while explicitly excluding paths typically associated with legitimate Windows system and program directories.
Detects suspicious execution of kernel-related networking commands ('unshare', 'ip', 'modprobe', 'insmod') by non-root users that are associated with the setup or exploitation phases of the 'DirtyClone' Linux kernel privilege escalation exploit. The rule specifically looks for IPsec tunnel/policy manipulation or the loading of ESP/RxRPC kernel modules by unprivileged accounts.
Page 405 of 976