Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
918 detections
Filters
Last updated
All Time
Detection languages
502
138
62
49
48
Contributors
250
202
86
62
43
Categories
659
657
269
159
112
Platforms
701
279
192
27
18
Products / Services
200
159
104
88
58
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
918
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Detects process execution indicative of the npm binding.gyp GYP shell expansion exploit used in the Miasma campaign to silently run node. This rule specifically looks for Node.js process executions with a command line matching a unique regex pattern associated with the exploit: 'node index.js > /dev/null 2>&1 && echo stub.c'.
Detects the execution of commands indicative of a user pasting a malicious script into the Terminal, often associated with ClickFix or fake CAPTCHA social engineering attacks. This typically involves using tools like `curl` to download and pipe payloads directly to a shell, or the use of `pbpaste` to execute clipboard contents.
This rule detects HTTP web requests where the URI contains the string "/bin/sh" (case-insensitive). This pattern is often indicative of an attempt to execute a Unix shell command via a web application, which could be part of a command injection attack (ATT&CK T1059.004).
Detects suspicious execution of the Bun runtime executing a JavaScript payload from the /tmp directory, matching the Miasma stage-four execution pattern. This rule specifically looks for the Bun executable running a JavaScript file named 'p<random>.js' within the /tmp directory, which is characteristic of the Miasma credential stealer.
Detects the execution of curl on macOS using a hardcoded Catalina user agent (Mac OS X 10_15_7) and silent/fail-fast flags (-fsSL). This pattern correlates with the macOS terminal payload delivery mechanism used in the ClearFake/ClickFix campaign.
Scripting Interpreter Exec
Cortex XDR
This rule detects suspicious command execution patterns on Linux systems involving scripting interpreters. Specifically, it looks for these interpreters being invoked with command-line arguments that suggest direct execution of code. This pattern is commonly associated with web shell activity, reverse shells, or other forms of arbitrary code execution.
This rule detects attempts to execute the Unix shell '/bin/bash' via HTTP requests. Specifically, it looks for the string '/bin/bash' within the URI of HTTP traffic flowing to the server. This could indicate an attacker attempting command injection or other web-based exploitation to gain shell access.
Detects an NGINX worker process spawning a shell or interpreter process, the post-exploitation primitive for CVE-2026-42945 (NGINX Rift). The exploit chain corrupts the ngx_pool_t cleanup handler and triggers system() with attacker-controlled shell commands, causing the nginx worker to fork /bin/sh with the -c flag. Since system() always invokes /bin/sh -c, the highest-fidelity match is nginx → /bin/sh -c <command>. Generalizes to catch arbitrary interpreter spawning (bash, python, perl, ruby, netcat variants, socat) which would result from any future post-exploitation pivot. Scoped to Linux because the exploit relies on the fork-based multi-worker architecture (Linux/BSD only). Windows nginx is not affected by the heap feng shui exploitation primitive.
Identifies package managers (like npm or yarn) executing suspiciously placed setup binaries from hidden or unconventional folders (e.g., tools/setup, .github/scripts/precheck) indicative of IronWorm preinstall hooks.
Detects the exploitation primitive of CVE-2026-3102 at the post-injection execution layer. The exploit succeeds when exiftool constructs a /usr/bin/setfile command line containing attacker-injected shell metacharacters (single quotes for command injection, backticks or $() for command substitution, semicolons for command chaining). Detecting setfile invocations spawned by exiftool with these characters in arguments is the smoking-gun signal. Even future variants of this vulnerability class (or related n-day exploits in the same family) would produce this same parent/child + metacharacter pattern.
Detects processes utilizing ${IFS} in conjunction with Base64 decoding. This technique is used by the Gogs argument injection exploit to bypass Git branch name space restrictions while delivering encoded shell payloads.
Detects `git rebase` commands containing the `--exec=` flag when spawned by a Gogs or Gitea server process. This activity is indicative of the exploitation of an argument injection vulnerability (CVE-2022-46153) in Gogs/Gitea, which allows an authenticated user to achieve Remote Code Execution (RCE) by creating a pull request with a specially crafted branch name. The rule specifically looks for `git` or `git.exe` processes executing `rebase` with `--exec=` and originating from `gogs`, `gitea`, or common shell processes that might be spawned by them.
Detects git rebase commands containing the `--exec=` flag, which is indicative of the argument injection vulnerability used to achieve RCE in Gogs. This rule specifically looks for the execution of 'git' or 'git.exe' with 'rebase' and '--exec=' in the command line.
Awk System Execution
Cortex XDR
This rule detects the execution of 'awk' on Linux systems when its command line contains includes suspicious functions like. This pattern is often indicativeof malicious script execution or command injection attempts using awk.
Detects make explicitly loading a Makefile from temporary or non-standard locations, often used to run arbitrary commands (due to writeable capability) via a trusted build utility.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
This rule detects a potential privilege escalation attempt on Linux systems. It looks for two main indicators: first, the execution of the 'su' command from a user's home directory by a process whose executable was recently created in a user's home directory and identified as an ELF binary. Second, it identifies systems where public-facing network connections were made by processes using common remote file transfer utilities (curl, wget, lftp, axel, aria2, scp, rsync, ftp) to fetch code, followed by the execution of a process with 'algif-aead' in its command line, which could indicate fileless execution after remote code fetching. The combination suggests an attacker might be fetching malicious code, potentially compiling it, and then using it to escalate privileges via 'su' or executing it filelessly.
Detects the execution of the public Dirty Frag exploit tool by monitoring for its hardcoded command-line arguments (--force-esp, --force-rxrpc). This vulnerability allows local attackers to gain root privileges via page-cache tampering in the Linux kernel without race conditions.
Detects suspicious command execution originating from cPanel daemons. This rule identifies instances where cPanel processes (cpsrvd, cpsrvd-ssl, cpaneld, whostmgrd) or their immediate children execute common shell interpreters or specific commands indicative of potential compromise, such as writing to /etc/passwd, modifying authorized_keys, or using base64/perl/python/bash for interactive shells.
Page 35 of 44