Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
918 detections
Filters
Last updated
All Time
Detection languages
502
138
62
49
48
Contributors
250
202
86
62
43
Categories
659
657
269
159
112
Platforms
701
279
192
27
18
Products / Services
200
159
104
88
58
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
918
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Detects attempts to exploit the Apache bRPC heap profiler command injection vulnerability, CVE-2025-60021. This is done by monitoring for HTTP GET requests to the `/pprof/heap` endpoint where the `extra_options` parameter contains shell metacharacters indicative of an RCE attempt.
Detects various activities associated with the ShadowHS fileless Linux post-exploitation framework, including fileless execution, specific command-line patterns, covert exfiltration, and connections to known C2 infrastructure.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects the execution of a piped command chain typical of 'ClickFix' lures used by the MacSync infostealer. The malware tricks users into pasting a command into the terminal which uses curl to download a payload, decodes it with base64, and pipes it directly into a shell (zsh, sh) or osascript for execution, bypassing macOS security controls like Gatekeeper.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects the execution of the `iwpriv` utility by an unprivileged user targeting subcommands that are vulnerable to Local Privilege Escalation (LPE) in certain MediaTek Wi-Fi drivers. The exploitation of these vulnerabilities is demonstrated to be possible by unprivileged users, making the execution of kernel-level configuration tools like `iwpriv` by non-root users a highly suspicious activity.
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects exploitation of a remote code execution vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The attack involves an authentication bypass followed by the upload and execution of a malicious XSLT template, leading to command execution and potential web shell deployment.
Detects Indicators of Compromise (IOCs) associated with React2Shell (CVE-2025-55182) exploitation attempts. This includes network connections to known malicious IP addresses, DNS queries for attacker-controlled domains, process creations involving suspicious command-line arguments (often related to downloading or executing scripts/binaries), and file hashes of known malicious artifacts. The exploit activity is linked to C2 communication, data exfiltration, and potentially cryptomining activities.
Detects the creation of a persistent GitHub self-hosted runner named 'SHA1HULUD', a technique used by the Shai-Hulud 2.0 malware for persistence and remote command execution. The rule specifically looks for process command lines containing " --name SHA1HULUD".
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Detects curl downloading a file, making it executable with chmod, and executing it in the background, common in FlexibleFerret malware delivery on macOS systems.
Detects the execution of shell scripts and creation of files associated with the FlexibleFerret macOS malware campaign, which is tied to fake job recruitment lures to trick users into executing malicious commands.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detects extraction of FlexibleFerret malware payload archive to the CDrivers directory on macOS systems.
Detects relevant commands often related to malware or hacking activity
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
Detects the in-memory execution of AppleScript or JXA payloads via osascript, a technique used by the DigitStealer malware to download and run malicious code while evading file-based detections.
Page 40 of 44