Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
14
3
1
Contributors
7
5
4
1
1
Categories
9
3
2
2
2
Platforms
9
5
3
1
1
Products / Services
3
2
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects invocation of the Hermes Agent 'godmode' LLM jailbreaking skill — the literal string 'godmode' appearing in application messages or commands together with agent/skill/jailbreak/red-team context, or an explicit 'godmode' skill name — indicating an attempt to bypass an LLM's built-in safety controls for autonomous offensive tasking.
Detects command lines consistent with ArachneC2 implant generation and hardening options.
Detects creation of cloud accounts for establishing attack infrastructure
Detects API access to VPS providers for spinning up attack infrastructure
Detects API access to VPS providers for spinning up attack infrastructure
This rule detects attempts to download malware builder tools (such as builders, generators, crypters, or packers) from raw.githubusercontent.com. It specifically looks for HTTP traffic where the host is 'raw.githubusercontent.com' and the URI contains keywords commonly associated with malware development tools.
Detects program executions in suspicious non-program folders related to malware or hacking activity
Detects the execution of the PurpleSharp adversary simulation tool
Detects file creation patterns noticeable during the exploitation of CVE-2021-40444
Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll
Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675
Detects the execution of the PurpleSharp adversary simulation tool
This rule detects the execution of various known hacktools on Linux systems by monitoring process creation events and matching against a predefined list of tool names in the 'Image' field. The tools covered include C2 frameworks (e.g., Cobalt Strike, Metasploit, Havoc, Merlin, Sliver), network scanners (e.g., Nmap derivatives, Nuclei, Recon-ng), web enumeration tools (e.g., Dirb, Ffuf, Gobuster), web vulnerability scanners (e.g., Nikto, WPSCan), and other exploit/post-exploitation tools (e.g., Aircrack-ng, Bloodhound-Python, Hashcat, Hydra, John, SQLMap, PEASS-ng).
Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.
Detects known hacktool execution based on image name.
This rule detects the execution of programs from suspicious directories on Linux systems. These directories are commonly used by malware or attackers for staging and executing malicious payloads, including temporary folders, web server directories, and data directories of typically exploited services like PostgreSQL, MySQL, and FTP. The rule specifically looks for SYSCALL events where the executable path starts with one of the predefined suspicious paths.
Detects the execution of the PurpleSharp adversary simulation tool by looking for specific image paths, original filenames, or command-line arguments associated with the tool. This rule helps identify when an adversary simulation or red team exercise involving PurpleSharp is being conducted on a system.
Detects the execution of the PurpleSharp adversary simulation tool