Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
116
41
34
33
20
Contributors
106
38
28
23
20
Categories
165
157
111
46
39
Platforms
229
188
103
9
9
Products / Services
10,657
9,755
6,688
4,418
3,745
295
MITRE Techniques
172
112
60
51
43
CVEs
6
6
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects vLLM executing inline Python commands using the '-c' flag, a common post-exploitation technique. This rule specifically looks for process command lines containing 'vllm' and a Python interpreter (python or python3) executing code via the '-c' flag, which is indicative of inline command execution.
This rule detects outbound UDP network traffic to high ports (greater than 1024, excluding common ports like 5353, 5355, 3389) initiated by interpreted language processes such as Python, Node.js, PowerShell, or WScript. This pattern can be indicative of Command and Control (C2) communication, particularly associated with botnet DHT (Distributed Hash Table) or custom C2 routing mechanisms.
Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.
Detects macOS Python processes creating zip archives in temporary or 'collected_data' folders, potentially indicating data collection and exfiltration staging. The rule specifically looks for Python processes that have previously accessed sensitive paths like 'login.keychain-db' or performed data collection/compression activities.
Detects Python enumerating browser extensions and desktop wallet paths associated with cryptocurrency key material. This rule specifically looks for Python processes executing with command-line arguments containing keywords related to cryptocurrency wallets (e.g., 'wallet', 'keystore', 'metamask').
Detects Python recursively searching repositories for .env files, package credentials, API keys, access tokens, or connection strings. This activity is associated with the InvisibleFerret malware.
Detects Python creating an archive containing browser, wallet, developer, cloud, and authentication data from multiple collection roots. This activity is associated with the InvisibleFerret malware.
Detects the execution of Python-based OpenClaw modules running directly out of newly cloned or extracted GitHub repository structures, specifically looking for Python processes where the command line includes patterns indicative of a cloned or extracted repository (e.g., '-main' or '-master' followed by a Python script).
Detects the execution of base64 decoded payloads in memory by interpreted languages such as Python or Node.js. This rule specifically looks for command-line arguments indicating base64 decoding or zlib decompression operations.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory, often associated with the XWorm malware.
Detects InvisibleFerret decoding XOR-encoded C2 IP strings.
Detects Python scripts making outbound network connections directly to IP addresses without prior DNS resolution. This behavior can strongly indicate hardcoded Command and Control (C2) communication, where an adversary has embedded the C2 server's IP address directly into the script to bypass DNS-based security controls or to ensure connectivity even if DNS is compromised or unavailable. The rule filters out private IP addresses and aggregates connections by device and remote IP, flagging those with a low connection count (less than 10) to reduce noise from legitimate, high-volume bare-IP traffic.
Detects anomalous outbound network connections originating from the Python/vLLM process to irregular ports or cloud metadata IPs. This behavior may indicate command-and-control establishment, secondary staging, or cloud metadata pivoting following a successful CVE-2026-22778 exploit.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
Detects Python processes that import 'unicode.py' and attempt to load 'terminate.dll' during an 'is_color_supported' call. This behavior is indicative of the ZiChatBot dropper, which uses this deceptive function to trigger its malicious payload.
Detects Python transmitting a newly created archive or JSON collection through requests, urllib, aiohttp, or a custom socket. This behavior is associated with the InvisibleFerret malware.
Detects Python processes attempting to decrypt browser credential databases using DPAPI or CryptUnprotectData. This behavior is characteristic of malware like InvisibleFerret, which targets stored browser credentials.
Detects Python loading a .pyd or .so extension from common user-controlled or temporary directories (AppData, Temp, Downloads, Projects, /tmp/, /home/.../Downloads/) rather than a trusted package installation. This behavior is indicative of the InvisibleFerret malware, which uses Cython extensions for its operations.
Detects Python searching local vaults and configuration for password managers such as KeePass, 1Password, Bitwarden, or LastPass. This activity is associated with the InvisibleFerret malware.
Detects Python scripts utilizing ctypes, ptrace, or process_vm_readv to perform advanced, programmatic memory scraping without relying on shell utilities. This activity can be indicative of credential dumping or other forms of sensitive data exfiltration from process memory.
Detects the Python interpreter executing with a command line containing a specific string fingerprint ('lzcdrtfxyqiplpd') associated with the Glassworm obfuscation variant. This indicates potential obfuscated code execution.
Page 10 of 15