Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
This rule detects instances where the Terraform CLI tool connects to suspected lookalike domains associated with supply chain compromise attempts (e.g., hashicorp-aws[.]com or hashicorp-terraform[.]io) during common initialization or application workflows. It correlates process execution with network connection logs and optionally validates the presence of a related .terraform.lock.hcl file associated with the malicious origin.
Detects execution or file presence associated with the TraderTraitor malware, specifically targeting known malicious file paths or SHA1 hashes used by the actor to masquerade as legitimate macOS system utilities (iTunesCloud, iSync, AppleAccountd).
This rule detects instances where the Terraform CLI tool connects to suspected lookalike domains associated with supply chain compromise attempts (e.g., hashicorp-aws[.]com or hashicorp-terraform[.]io) during common initialization or application workflows. It correlates process execution with network connection logs and optionally validates the presence of a related .terraform.lock.hcl file associated with the malicious origin.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
Detects incoming HTTP requests to Microsoft Exchange servers that match patterns indicative of exploitation attempts for the ProxyLogon SSRF vulnerability (CVE-2021-26855). This includes detecting specific manipulation of the Autodiscover service and the injection of X-BEResource or X-AnonResource-Backend headers, which were commonly used during the initial access phase of this campaign.
Detects web server processes (e.g., Apache, Nginx, PHP-FPM, IIS) launching suspicious shell or system administration utilities. This behavior is indicative of a web server compromise, potentially involving the use of web shells or the exploitation of public-facing web applications to execute arbitrary commands.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
Detects post-exploitation shell activity spawned from the IIS worker process (w3wp.exe), narrowed to command lines carrying encoded/obfuscated PowerShell flags, remote-download cradles, or basic recon/persistence commands (whoami, certutil, bitsadmin, schtasks, reg add). This reduces noise from benign w3wp.exe-initiated automation while retaining the behavioral pattern seen in the Telerik UI for ASP.NET AJAX unauthenticated RCE chain (webshell/in-memory DLL execution dropping to a shell).
Detects HTTP requests that use URL-encoded backslash traversal sequences
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Page 10 of 58