Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
1
MITRE Techniques
1
1
1
1
1
CVEs
71
71
64
58
49
Detects potential exploitation of CVE-2026-59726 (RufRoot) against the Ruflo MCP bridge service. The rule identifies when the 'node' or 'ruflo' processes spawn shell interpreters (sh, bash) with command-line arguments typical of initial reconnaissance (id, hostname, whoami, uname) or arbitrary command execution, indicative of an unauthenticated remote code execution attempt.
Detects post-exploitation persistence and anti-forensic activity associated with the RufRoot/CVE-2026-59726 vulnerability. The rule identifies the creation of unauthorized .js files within application directories, the modification of 'index.js' followed by a SIGKILL to process ID 1 to force a container restart, and attempts to clear bash command history to hide malicious footprints.