Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
113 detections
Filters
Last updated
All Time
Detection languages
47
22
12
8
8
Contributors
36
28
14
11
5
Categories
63
25
22
18
14
Platforms
49
38
31
17
7
Products / Services
15
14
13
13
10
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
12
12
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects instances where Microsoft Copilot memory content (identified by hash) remains identical before and after a significant account security event, such as a password reset or session revocation. This behavior suggests that an adversary may have injected malicious or persistent data into the user's Copilot memory, which survives standard account remediation actions.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
Detects the execution of the temp_auto_push.bat tool, associated with the threat actor Void Dokkaebi, used to perform malicious commit amendments and code injection in source code repositories. The tool achieves this by manipulating the system clock to timestomp commit metadata, amending commits using 'git commit --amend --no-verify' to bypass security controls, and force-pushing the compromised history.
Flags modifications to the Windows hosts file made by an unsigned process or a process freshly dropped in a temp folder within the last 10 minutes, consistent with Abyssos's DNS_ADD/DNS_DEL hosts-file manipulation.
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects the creation of a 'C:\user.png' file, which is known to be used as a marker file by NoEscape ransomware/wiper malware at the root of the system drive.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
This rule detects potentially unauthorized or suspicious developer activity, specifically focusing on the execution of custom scripts like 'temp_auto_push.bat', automated task execution via VS Code 'tasks.json' files, and git commands that bypass security checks using '--no-verify'. These activities may indicate repository tampering, modification of source code integrity, or attempts to automate actions that circumvent established development workflows.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
This rule monitors for suspicious Git command-line activity that may indicate an attempt to rewrite commit history or force push changes while bypassing verification checks. It detects specific patterns including the execution of 'temp_auto_push.bat', force amending of commits with '--no-verify', and forced pushing with '--no-verify'. These actions are commonly associated with code tampering or the rapid deployment of unauthorized changes to a repository.
This rule detects potentially unauthorized database manipulation of the 'xadmin' platform, including suspicious administrative role modifications and deletions. It also monitors for suspicious Python script execution involving the 'bcrypt' library, which can be used to generate or verify password hashes in potentially malicious scripts.
Detects the use of Git commands (filter-branch, rebase -i, or force-push) that rewrite local or remote commit history. These operations are often used by adversaries to hide malicious code injections, remove evidence of unauthorized changes, or manipulate developer repository integrity.
Page 4 of 6