Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
522 detections
Filters
Last updated
All Time
Detection languages
274
88
34
34
26
Contributors
144
82
54
25
22
Categories
350
258
247
69
63
Platforms
404
216
113
16
9
Products / Services
149
114
100
31
30
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
14
4
3
3
3
IDS Classtypes
7
2
1
1
IDS Protocols
11
Detects process execution patterns associated with the Mini Shai-Hulud malware, including lifecycle hook
execution, daemonized Node.js processes, and PyPI payload execution.
execution, daemonized Node.js processes, and PyPI payload execution.
Detects the creation or presence of specific artifact files (.ghostlock_authorized and ghostlock_cache.json) associated with the GhostLock proof-of-concept availability weapon. These files are used by the tool to manually authorize locking operations in specific directories and to cache discovered file lists for rapid session re-establishment.
Detects execution of Python with PySoxy SOCKS5 proxy arguments (-ssl, -remote_port, -remote_ip) alongside compiled bytecode (.pyc) execution. PySoxy is a 10-year-old open-source SOCKS5 proxy that ReliaQuest observed being deployed via ClickFix as a secondary encrypted access path alongside PowerShell-based C2. The specific combination of these three argument flags with .pyc execution is rare in legitimate use and represents the PySoxy invocation pattern verbatim.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects suspicious command execution originating from cPanel daemons. This rule identifies instances where cPanel processes (cpsrvd, cpsrvd-ssl, cpaneld, whostmgrd) or their immediate children execute common shell interpreters or specific commands indicative of potential compromise, such as writing to /etc/passwd, modifying authorized_keys, or using base64/perl/python/bash for interactive shells.
Detects the execution of 'module.pyw' using 'pythonw.exe', which is a technique employed by Operation HumanitarianBait to silently run an infostealer. This rule specifically targets the combination of the windowless Python interpreter and the known payload script name.
Detects pythonw.exe executing .pyw scripts from user-writable directories outside canonical Python installation paths. This execution pattern is used by Operation HumanitarianBait (module.pyw from %APPDATA%\WindowsHelper) and similar PyArmor-packed Python infostealer campaigns like PXA Stealer and JarkaStealer. These campaigns drop self-contained Python environments into vendor-mimicking AppData subdirectories. The rule catches the specific HumanitarianBait path/script combination and variants that alter the path or script name while maintaining the windowless-Python-from-AppData primitive.
Detects Python command lines referencing a specific cryptographic string ('authencesn(hmac(sha256),cbc(aes))') known to be used in the exploitation of the 'Copy Fail' vulnerability (CVE-2026-31431). This string is highly specific and its presence in a Python command line is indicative of an attempt to exploit this particular CVE.
Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.
Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.
High-confidence detection for probable Copy Fail exploitation requiring AF_ALG or algif_aead references, syscall-style splice usage, and privileged binary targeting. https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py https://xint.io/blog/copy-fail-linux-distributions#how-we-found-it-9
This rule detects the execution of a Python proof-of-concept script named 'exp.py' followed by the execution of the 'su' binary on the same Linux host within a 5-minute window. This correlation is indicative of an attempt to exploit the 'Copy Fail' vulnerability (CVE-2026-31431), which leverages AF_ALG sockets to perform an in-memory page cache overwrite of the 'su' setuid binary to gain a root shell.
This rule detects the execution of Python processes on Linux systems that include a specific cryptographic template string in their command line. This string, "authencesn(hmac(sha256),cbc(aes))", is indicative of a Proof-of-Concept (PoC) exploit related to CVE-2026-31431, also known as 'Copy Fail'. The detection targets Python binaries (python, python3, or versioned python3.x) and aims to identify attempts to leverage this vulnerability for suspicious cryptographic operations.
This rule detects the execution of Python interpreters on Linux systems where the command line contains a specific AF_ALG cryptography template. This template is associated with a known vulnerability (CVE-2026-31431) and is considered highly suspicious due to its rarity in legitimate command lines. The detection targets the 'authencesn(hmac(sha256),cbc(aes))' string within the Python command line arguments.
Detects the execution of a Python interpreter (pythonw.exe) running the 'appclient' module from within the C:\ProgramData\Tailscale directory. This technique is used by the Silver Fox APT group to deploy the ABCDoor backdoor while masquerading as legitimate VPN software to evade detection.
This rule detects the presence of suspicious script content (e.g., 'system(', 'exec(', '/dev/tcp/') within Python (.py) or shell (.sh) files located in common plugin directories on Linux systems. This could indicate an attempt to inject malicious code into package management configurations for persistence or privilege escalation.
Detects Python executables spawning shell interpreters such as cmd.exe or powershell.exe. This activity is indicative of the SNOWBASIN local HTTP bindshell proxying and executing remote commands on the host system on behalf of the attacker, as observed in UNC6692 campaigns.
Detects a Python process initiating outbound network connections to common administrative and remote access ports (135, 445, 3389). This activity is indicative of the internal port scanning phase used by UNC6692 prior to lateral movement in their SNOW ecosystem deployment.
Detects php/perl/ruby one-liner execution patterns combined with network or shell invocation primitives, consistent with trusted interpreter abuse and execution guardrail bypass.
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Page 20 of 25