Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects activities indicative of a Docker container escape, specifically targeting the 'docker cp' path traversal vulnerability. It monitors for suspicious command-line patterns involving path traversal sequences ('../'), execution of shells or common utilities from container-related processes (dockerd, containerd, etc.), and the presence of known proof-of-concept artifacts or files written outside the expected container boundary.
Detects potentially malicious container escape or privilege escalation attempts initiated by Gitea act runner processes. This includes the spawning of 'nsenter', the use of dangerous Docker flags that provide host-level access (such as host PID/IPC namespaces, all capabilities, or disabled security mechanisms), and the spawning of shells inside containers configured with namespace-entering commands.
Detects unauthorized SSH-based lateral movement originating from a compromised Cisco SD-WAN vManage controller to vSmart or vBond components. The rule monitors for SSH sessions initiated by administrative users (admin, vmanage-admin) and subsequent unauthorized file permission modifications (chmod/chown) on sensitive system files and directories, such as SSH authorized_keys and system configuration files, which are indicative of post-exploitation activities.
Detects post-exploitation activities on Cisco SD-WAN Manager (vManage) systems. The rule identifies suspicious command execution patterns including shell spawning via SSH, use of administrative/backdoor accounts (troot), privilege escalation attempts using su, enumeration commands commonly used by attackers, unauthorized modification of sensitive system files (/etc/passwd, /etc/shadow), the use of specific malicious tenant-upload CLI operations, and outbound reverse-shell connections.
Detects execution of potentially malicious processes masquerading as 'pythonw.exe' or 'userscreen.exe', specifically when they exhibit behavior associated with the APT37 NarwhalRAT. The rule identifies processes loading critical system DLLs (kernel32.dll, ntdll.dll) while simultaneously initiating network connections to known C2 infrastructure within a 10-minute window.
Detects the Windows UAC consent.exe process loading msimg32.dll from a non-standard, potentially user-writable location, a technique associated with BumbleBee malware campaigns for DLL sideloading. The rule further inspects the parent process context to ensure consent.exe was launched by an expected parent (svchost.exe) and validates the DLL's signature.
Detects the installation of 'cloudflared.exe' as a Windows service from a non-standard file path. The rule specifically correlates this service installation with preceding PowerShell commands typically used to download remote files, consistent with tradecraft observed in Akira and Bumblebee campaigns to establish covert C2 tunneling.
Detects the use of the RoadTx tool to perform a Resource Owner Password Credential (ROPC) grant against Microsoft Graph while bypassing MFA. This behavior leverages CVE-2025-0309 by abusing hidden Conditional Access exclusions for specific client IDs, resulting in an authentication token issued without an MFA claim.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
Detects the installation of the Cloudflare Tunnel (cloudflared) utility as a Windows service, often used by threat actors to establish persistent, outbound command-and-control (C2) channels that bypass standard network perimeter controls. This rule monitors for PowerShell-based downloads from GitHub, silent MSI-based installation, and the execution of the 'service install' command.
Detects the Atomic macOS Stealer (AMOS) malware establishing persistence by creating a LaunchAgent plist file ('com.hlpr.agent.plist') and subsequently loading it using the 'launchctl' utility.
Detects the creation of scheduled tasks using schtasks.exe where the task action executes a scripting engine or living-off-the-land binary (LOLBin). This behavior is often indicative of adversaries attempting to establish persistence or execute code using native system tools to evade detection.
Detects reflective process injection attempts where a suspicious executable, masquerading as 'Mixed Reality.exe' in a Windows Media Player directory, attempts to inject code into the svchost.exe system process using cross-process memory operations like CreateRemoteThread.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.
Detects potential container escape attempts leveraging path traversal vulnerabilities in the 'docker cp' command (e.g., CVE-2026-55199). The rule identifies file creation events triggered by docker processes where the target file path is outside the expected Docker root or temporary directory structures, suggesting an effort to write files to arbitrary locations on the host filesystem.
Page 68 of 401