Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
522 detections
Filters
Last updated
All Time
Detection languages
274
88
34
34
26
Contributors
144
82
54
25
22
Categories
350
258
247
69
63
Platforms
404
216
113
16
9
Products / Services
149
114
100
31
30
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
14
4
3
3
3
IDS Classtypes
7
2
1
1
IDS Protocols
11
Detects Python or curl downloading payloads from the PySoxy staging IP 206.206.103.106. This indicates potential ingress tool transfer or staging activity by an adversary.
Detects the creation of the '.bun_ran' run-once marker in a temporary directory or suspicious Python '.pth' startup hooks (e.g., 'langchain_core-setup.pth') indicative of the Hades loader variant. The '.bun_ran' file acts as a marker for the loader, while '.pth' files can be used to inject malicious code into Python's import mechanism, achieving persistence or execution.
This rule detects unusual child processes spawned from critical Windows system binaries (svchost.exe, lsass.exe, csrss.exe, winlogon.exe, system.exe). Specifically, it looks for these parent processes launching command-line interpreters or scripting engines like PowerShell, cmd, Python, or Java, excluding common legitimate child processes such as conhost.exe, csc.exe, taskkill.exe, and services.exe. A count of 2 or more such events within an hour on the same computer triggers an alert, indicating potential malicious activity like privilege escalation or execution.
This rule detects attempts to fetch Python package files (setup.py or __init__.py) from pypi.org over HTTP. This activity could indicate a client attempting to download or interact with Python packages, potentially including malicious ones, from the Python Package Index. The rule uses a threshold to alert on frequent occurrences from the same source.
This rule detects the execution of 'python.exe' from within common Chromium-based browser application directories (Google Chrome, Microsoft Edge, Brave Browser). This activity is highly suspicious as Python should not legitimately execute from these paths under normal circumstances. Threat actors, such as UNK_DeadDrop, have been observed using this technique to bypass application-bound encryption path validation and steal sensitive data like browser credentials. Detection of this behavior indicates potential malicious activity, including credential theft or other forms of evasion.
Detects the Miasma/Hades langchain-core-mcp malicious Python startup-hook loader
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
Detects the execution of 'cg.exe', a secondary compiled Python executable deployed by SilentRunLoader (associated with TA4922) to pack and steal Google Chrome browser data. The detection specifically looks for 'cg.exe' where the initiating process or command line contains 'python'.
This rule detects unusual child processes spawned from critical Windows system binaries (svchost.exe, lsass.exe, csrss.exe, winlogon.exe, system.exe). Specifically, it looks for these parent processes launching command-line interpreters or scripting engines like PowerShell, cmd, Python, or Java, excluding common legitimate child processes such as conhost.exe, csc.exe, taskkill.exe, and services.exe. A count of 2 or more such events within an hour on the same computer triggers an alert, indicating potential malicious activity like privilege escalation or execution.
Detects the execution of cg.exe, a secondary Python executable dropped by SilentRunLoader specifically to pack and steal Chrome browser data. This activity is associated with TA4922.
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
This rule detects the download of a Python script that appears to be a reverse shell. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "import socket" and "connect(" within the file data, case-insensitive. These strings are common indicators of Python code attempting to establish a network connection, often used in reverse shell implementations.
Detects the execution of `cg.exe`, a secondary Python executable dropped by SilentRunLoader specifically to pack and steal Chrome browser data. This behavior is indicative of TA4922 activity.
Scripting Interpreter Exec
Cortex XDR
This rule detects suspicious command execution patterns on Linux systems involving scripting interpreters. Specifically, it looks for these interpreters being invoked with command-line arguments that suggest direct execution of code. This pattern is commonly associated with web shell activity, reverse shells, or other forms of arbitrary code execution.
Detects the creation of the specific sentinel file '.bun_ran' generated by the Hades Python loader to avoid repeated executions.
This rule detects the download of a Python script that contains code indicative of operating system command execution. Specifically, it looks for the strings "os.system(" and "subprocess" within HTTP response data, suggesting the script intends to execute system commands.
Detects Python processes (python.exe, pythonw.exe) making more than 3 connections to public IP addresses. This activity could indicate data exfiltration, command and control communication, or other suspicious network behavior originating from a Python script.
Detects the installation of specific Python packages (requests, paramiko, beautifulsoup4) combined with potential system-breaking flags, indicating the preparation phase for C0XMO's standalone lateral movement scanner.
KQL Query
Detects file and process activity related to the compromised Nx Console 18.95.0 VS Code extension, including known payload artifacts such as cat.py, kitty staging paths, LaunchAgent persistence, and daemonized execution indicators. This may indicate possible supply-chain compromise activity on a developer endpoint. Nx confirmed that version 18.95.0 was malicious and wrote artifacts such as ~/.local/share/kitty/cat.py, /tmp/kitty-*, /var/tmp/.gh_update_state, and macOS LaunchAgent persistence.
Detects programmatic file access in Microsoft 365/SharePoint environments where the operation is logged as 'FileAccessed' but the UserAgent indicates a scripting library like python-requests or PowerShell. This behavior is indicative of data exfiltration techniques used by actors like UNC6671 (BlackFile) who stream file content directly to bypass traditional 'FileDownloaded' monitoring.
Page 19 of 25