Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects activity associated with the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It identifies two main indicators: first, process command lines that show the installation of these specific malicious versions via 'pip' or 'python -m pip'; second, network connections to a known command and control (C2) IP address (83.142.209.203) or specific C2 URLs involving '.wav' files, which are known to be used for steganography in this campaign. A match indicates a high confidence of potential compromise and warrants immediate investigation to confirm the affected host and user, assess the legitimacy of the activity, and review for follow-on malicious actions.
This rule detects instances where 'dllhost.exe' is spawned by a parent process other than 'services.exe' or 'svchost.exe'. Dllhost.exe is typically used to host COM+ applications and should almost exclusively be initiated by these legitimate system processes. An unusual parent could indicate COM object hijacking, lateral movement, or process injection attempts.
Detects a Python-initiated process attempting to read Google Cloud Platform (GCP) credentials by looking for command-line arguments containing 'GOOGLE_APPLICATION_CREDENTIALS' and 'cat 2>/dev/null'. This behavior is indicative of credential harvesting, potentially related to supply chain compromises like the Trivy incident.
Detects processes referencing confirmed TeamPCP C2 infrastructure or known malicious artifacts from the Trivy supply chain compromise. This includes specific C2 domains/IPs, temporary runner files, and a specific tarball name. It also looks for `entrypoint.sh` executing `grep` for environment variables or SSH-related strings, which could indicate credential access attempts.
Detects attempts to discover GitHub runner processes (Runner.Worker or Runner.Listener) using process enumeration tools like pgrep, ps, or grep. Adversaries may use this technique to locate processes carrying secrets on compromised CI/CD runners.
This rule detects various activities associated with the Charon ransomware, including DLL sideloading, ransomware deployment, payload reading, ransom note creation, shadow copy deletion, and service creation for persistence. It leverages specific filenames, process behaviors, and registry modifications to identify the threat.
This rule detects the presence or execution of files identified by specific SHA256 hashes or file names associated with PAM-based backdoors on Linux systems. It monitors device events, file events, process events, and image load events for these indicators. The rule aims to identify the 'Plague' PAM-based backdoor or similar malicious PAM modules.
Detects attempts to discover GitHub runner processes (Runner.Worker or Runner.Listener) using process enumeration tools like pgrep, ps, or grep. Adversaries may use this technique to locate processes carrying secrets on compromised CI/CD runners.
Detects the execution of JavaScript code within the Deno runtime via data URIs. This technique can be used by adversaries to execute in-memory payloads, bypassing traditional file-based detection mechanisms. The rule specifically looks for 'deno.exe' in the process filename or original filename and the presence of 'data:application/javascript' in the process command line.
This rule detects suspicious network connections or process executions initiated by processes whose command line contains specific 'ClawAgents' keywords and, in the case of process execution, also contains the keyword 'clone'. It specifically excludes known browser processes from the network connection detection to reduce false positives. The 'ClawAgents' appear to be related to a specific threat or toolset, and the 'clone' keyword suggests activities like cloning repositories or creating copies, which could be indicative of malicious operations.
This rule detects attempts to discover sensitive browser information by monitoring command-line executions. It specifically looks for processes that are not legitimate browser applications or security tools, attempting to access common browser profile paths and sensitive database files (e.g., Login Data, Cookies, History, places.sqlite, logins.json, key4.db, key3.db). This activity could indicate an adversary attempting to exfiltrate user credentials, browsing history, or other personal data stored by web browsers.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
Detects potential DLL side-loading activity associated with the MuddyWater threat actor. The rule identifies the legitimate Fortemedia application, FMAPP.exe, initiating network connections while running from a non-standard or suspicious directory, such as C:\Users\Public\Downloads\. This behavior is indicative of a malicious FMAPP.dll being loaded for command-and-control (C2) communications.
This query identifies potential post-exploitation behavior on Linux systems by monitoring for clusters of discovery and enumeration commands. Instead of alerting on single, potentially benign commands, it utilizes a behavioral scoring engine that categorizes activities such as credential hunting, privilege escalation, and network scanning.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
This rule detects the presence of files or processes with known malicious SHA256 or MD5 hashes. It queries both DeviceProcessEvents and DeviceFileEvents to identify if any file or running process matches the provided list of malicious hashes.
This rule detects the creation or interaction with mutexes that contain both 'asus_' and '_v' in their names. This pattern has been observed in malware associated with ASUS systems, potentially indicating the presence of malicious software attempting to establish a unique identifier on the compromised system.
Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.
Monitors for command-line activity indicating the addition of SSH keys to authorized_keys files or the modification of the SSH daemon configuration to permit root login on Cisco SD-WAN devices. This is a common persistence technique used by attackers after gaining initial access, such as through CVE-2026-20127.
This rule detects activity associated with a developer-targeting campaign leveraging malicious Next.js repositories. It identifies suspicious network connections to known Vercel staging domains and C2 IPs/ports/paths, as well as suspicious process execution patterns involving Node.js or VS Code related processes, and file events related to specific repository artifacts or sensitive file access by developer-adjacent processes. The detection logic covers network communication, process execution, and file system activities indicative of this specific threat.
Page 72 of 84