Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
63
27
11
4
4
Contributors
17
17
13
12
6
Categories
40
25
25
22
17
Platforms
95
39
22
1
1
Products / Services
21
16
14
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
1
1
1
IDS Classtypes
4
IDS Protocols
3
1
Detects modification of file associations to hijack execution flow
Detects WMI abuse for lateral movement, remote execution, and persistence
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by JavaScript runtimes (like node or bun). This activity may indicate a supply chain backdoor attempting to establish persistence within a project by modifying development environment configurations.
This rule detects attempts to modify the Windows Registry remotely, specifically targeting the 'HKLM' hive and paths containing 'shell\open\command'. This pattern is often used by adversaries to establish persistence or achieve privilege escalation by modifying how applications or the system execute commands, for example, by hijacking file associations or application startup commands. The detection is based on network traffic over TCP port 445, which is commonly used for SMB/CIFS, indicating a remote registry operation.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
This rule detects the delivery of a payload via HTTP that contains the string "SetWindowsHookEx" (case-insensitive). This string is associated with a Windows API function used to install a hook procedure that monitors system events. Attackers often use this technique for persistence or to inject malicious code into other processes.
This rule detects attempts to write shell event hook scripts, specifically those using 'trap' and 'SIGHUP', over an SSH connection. This activity is often associated with persistence mechanisms where an attacker sets up a script to execute upon certain shell signals, such as a hangup signal, to maintain access or execute malicious code.
This rule detects network traffic indicative of a remote WMI event subscription being registered. Specifically, it looks for TCP traffic on port 135 (typically used by Microsoft RPC and DCOM, which WMI can leverage) directed to the home network, containing the string "__EventConsumer" case-insensitively. This activity can be a sign of persistence mechanisms being established by attackers.
Detects creation or manipulation of the ROTATE subdirectory within the Skylight Metrics Agent path by non-SYSTEM accounts. CVE-2026-7791 exploitation requires replacing the legitimate ROTATE directory with a junction point targeting the attacker's desired write location. The Skylight service then follows the junction during its log rotation, writing attacker-controlled files to the target with SYSTEM privileges. Any non-SYSTEM interaction with this specific path warrants investigation.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.
COM Hijack via Sdclt
Sigma
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Get-Variable is a valid PowerShell cmdlet
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Control Panel Items
Sigma
Detects the malicious use of a control panel item
Detects Cursor IDE spawning download utilities or LOLBins commonly used for
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
Detects malicious udev rules for persistence
Detects the creation or modification of Python scripts in the /unitree/etc/programming/ directory on Unitree Go2 robots. This activity is a strong indicator of exploitation of CVE-2026-27509 or CVE-2026-27510, where an attacker uploads a malicious script for remote code execution.
This rule detects modifications to AI assistant configuration files by suspicious processes like package managers (npm, yarn) or shell interpreters (bash, powershell). This activity is indicative of a supply chain attack, specifically the SANDWORM_MODE campaign, where an attacker injects a rogue Model Context Protocol (MCP) server entry to hijack AI tools. This enables automated source code and secret theft via prompt injection.
Detects suspicious modification of AI assistant configuration files potentially related to MCP server injection.
Detects modification of core OpenClaw AI agent behavioral files (SOUL.md, AGENTS.md). Threat actors have been observed using malicious 'skills' to append instructions to these files, creating a 'cognitive rootkit' that persistently alters the agent's behavior.
Page 3 of 6