Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,884
5,166
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
Detects a multi-stage in-memory delivery chain associated with Operation Poisson, where wscript.exe spawns powershell.exe to load and execute the Havoc Demon agent in memory via a VBScript stager.
This rule detects the execution of processes where the image path or parent process path originates from anonymous memory file descriptors ('/memfd:') or file descriptor links ('/proc/self/fd/'). These patterns are frequently associated with fileless malware execution where binaries are executed directly from memory to avoid disk-based detection.
Detects the installation or initiation of an OpenSSH server (sshd) process, which may indicate an attacker establishing a persistent, redundant remote access backdoor. The rule monitors for common installation/enablement patterns across Windows (via sc.exe, PowerShell WindowsCapability) and Linux (via systemctl, service) and flags instances running from non-standard or temporary directories.
Detects potentially unauthorized or malicious loading of kernel modules on FreeBSD systems using the kldload command. The rule identifies suspicious activity by flagging modules loaded from non-standard directories, kldload processes spawned by untrusted parent processes (like web servers, shells, or scripts), and instances where the process was invoked with sudo/su by non-root users.
Detects indicators of the BUMSRAKETE exploit, specifically looking for malicious binary names, staging files, and a high-frequency loop pattern involving SUID binaries (su, passwd) by unprivileged users. This pattern is consistent with a kTLS page-cache corruption exploit targeting CVE-2026-45257.
Detects instances where JavaScript runtime processes (node, npm) execute specific peer-related or verification scripts and subsequently access sensitive system files or directories, such as SSH configurations, AWS credentials, or browser data, within a 5-minute window.
Detects execution of the Tailscale or Tailscaled process that is not initiated by standard system or management processes. This may indicate unauthorized installation or use of the Tailscale VPN software for covert command and control or lateral movement, especially when combined with immediate network activity to Tailscale infrastructure or ports.
Detects the creation of scheduled tasks using schtasks.exe that point to high-risk directories (Temp, AppData, ProgramData) or utilize obfuscated PowerShell commands (encoded parameters). This behavior is often associated with adversary persistence or initial execution.
Detects the execution of the TruffleHog tool, which is used for scanning Git repositories and codebases to discover exposed sensitive information, such as API keys and passwords. The rule monitors process execution command lines and filters out common CI/CD and automation service accounts to identify potentially malicious or unauthorized use of the tool on endpoints.
This rule detects a suspicious pattern involving two events occurring on the same host: the creation of a DLL file with a 'meow_' prefix (potentially associated with known malware patterns) and the execution of a command-line interpreter (cmd.exe, powershell.exe, or pwsh.exe) as a child process of suspicious parent processes like svchost.exe, services.exe, dllhost.exe, or msiexec.exe.
Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.
This rule detects node.js processes executing command-line arguments that attempt to perform system discovery. Specifically, it looks for node.js scripts invoking os-related modules (hostname, platform, cpus) or querying system environment variables (COMPUTERNAME, USERNAME) when the node process is launched by a parent process related to npm or node itself.
Detects the execution of the TruffleHog tool, which is used for scanning Git repositories and codebases to discover exposed sensitive information, such as API keys and passwords. The rule monitors process execution command lines and filters out common CI/CD and automation service accounts to identify potentially malicious or unauthorized use of the tool on endpoints.
Detects execution of PowerShell commands using suspicious combinations of flags, obfuscation techniques, or indicators often associated with fileless malware delivery, such as Base64 encoded commands, hidden window execution, and memory-resident loading (e.g., Invoke-Expression, IEX, VirtualAlloc). The rule scores based on the combination of indicators, flagging highly suspicious patterns.
This rule detects a suspicious pattern involving two events occurring on the same host: the creation of a DLL file with a 'meow_' prefix (potentially associated with known malware patterns) and the execution of a command-line interpreter (cmd.exe, powershell.exe, or pwsh.exe) as a child process of suspicious parent processes like svchost.exe, services.exe, dllhost.exe, or msiexec.exe.
Detects the execution of Python processes with command-line arguments indicative of keylogging activity (e.g., pynput, keyboard, keylog) or Python processes creating/writing to files with names suggesting keylogging behavior (e.g., log.txt, keylog). This rule targets potential data collection via keyboard interception by monitoring process creation and file write events.
Detects the presence and activity of Tailscale VPN, including process execution, command-line arguments, network connections to Tailscale infrastructure, and communications within the Tailscale CGNAT address range (100.64.0.0/10). This rule identifies the potential use of Tailscale for tunneling or remote access, which may be unauthorized in some environments.
Detects Node.js processes or npm-related parent processes writing suspicious files (e.g., .cjs, .tgz, package.json) into the node_modules directory. This behavior is often indicative of malicious supply chain activities, such as dependency confusion or post-install script injections observed in campaigns like Operation Poisson.
This rule detects suspicious execution of 'RUNDLL32.EXE' with specific command-line arguments. It looks for instances where 'RUNDLL32.EXE' is executed with both a backslash and a comma in the command line, combined with specific DLL names or keywords like 'iamnotarobot.dll', 'checkme.dll', 'machinerie.dll', 'humanCheck', or 'verifyme'. This pattern is often indicative of malicious DLL loading or persistence mechanisms.
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
Page 447 of 976