Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects a sequence of FTP SITE CPFR (Copy From) followed by SITE CPTO (Copy To) commands from the same source IP and computer within 5 minutes, which can be abused to copy files on the server.
Correlates a running ProFTPD FTP server process listening on TCP port 21 with commands checking or loading the mod_copy module on the same Linux device using Microsoft Defender XDR telemetry.
Detects a PHP file being written into a WordPress content directory
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
Detects VPN connection events where the client hostname contains the string 'kali', which may indicate the use of a penetration testing operating system or a suspicious device connecting to the corporate network via Palo Alto Networks GlobalProtect.
Finds BeyondTrust Remote Support (Bomgar) appliances at version 26.2.3 or earlier that have a public IP address, indicating a potentially internet-facing vulnerable appliance (CVE-2026-102764). Index and field names are placeholders to adapt.
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
This rule detects suspicious driver loading from user-writable paths, kernel driver service creation, disabling of driver signing, loading of Linux kernel modules, and the usage of LD_PRELOAD for rootkit functionality.
Detects configuration changes on the Zimbra server. Mail server configuration
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects the creation of WordPress administrator accounts using MySQL or WP-CLI command-line tools on hosts, specifically looking for specific username prefixes or email domains associated with suspicious activities.
Detects hosts with the trojanized version 3.0.123 of the Rank Math PRO WordPress plugin distributed in October 2026. It correlates software inventory, file events, command-line process events, and network connections to identify affected packages, installation activity, and C2 communications.
Detects HTTP requests to the PeopleSoft PSEMHUB servlet using alternate
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Page 10 of 347