Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects suspicious execution of the 'tar' utility spawned by 'prl_disp_service' (Parallels Desktop service) using potentially malicious command-line arguments. The rule specifically flags the use of '--use-compress-program' or the inclusion of double quotes in the command line, which are often used to achieve arbitrary code execution via shell injection in this context.
Detects the creation of files or folders containing suspicious command-line parameters associated with tar or Parallels toolchain injection, specifically looking for the 'use-compress-program' flag which can be abused for command injection.
This rule detects unauthorized modifications to the /etc/sudoers.d/ directory, specifically identifying files with a 'prl-rce-' naming pattern that contain 'NOPASSWD:ALL'. This configuration allows users to execute commands with elevated privileges (root) without requiring a password, which is a common technique used by attackers to maintain persistence and facilitate privilege escalation on Linux systems.
This rule detects unauthorized modifications to the /etc/sudoers.d/ directory, specifically identifying files with a 'prl-rce-' naming pattern that contain 'NOPASSWD:ALL'. This configuration allows users to execute commands with elevated privileges (root) without requiring a password, which is a common technique used by attackers to maintain persistence and facilitate privilege escalation on Linux systems.
Detects execution of the tar utility by the prl_disp_service process with a command line pattern indicative of command injection via the --use-compress-program flag. This technique is often used to execute arbitrary commands by embedding them within the compression program argument.
Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
Detects anomalous child process execution originating from PaperCut application processes (pc-app.exe) or associated Java processes. This is indicative of post-exploitation activity following an RCE vulnerability where the application server is leveraged to spawn command interpreters, discovery utilities, or ingress tools.
Detects DragonForce ransomware note (readme.txt) referencing known DragonForce Tor negotiation/blog onion addresses
Detects instances where Acronis processes spawn common administrative or potentially sensitive utilities (such as chmod, chown, bash, or sudo) while running as a user other than root. This behavior may indicate an attempt to utilize Acronis for privilege escalation or unauthorized command execution on Linux systems.
Detects the use of administrative utilities like chmod, chown, and setfacl to modify file permissions on paths or commands related to Acronis, cPanel, WHM, or Plesk. This activity could indicate an attempt to manipulate system or application binaries to facilitate privilege escalation or persistence.
This rule detects file creation, modification, or renaming activity involving Acronis plugins integrated with web hosting control panels such as cPanel, WHM, or Plesk, where the plugin version is identified as vulnerable. It specifically monitors for versions earlier than 1.9.3 (excluding specifically patched 1.9.3 HF3 versions) that are prone to exploitation.
Detects obfuscated PHP web shell activity within the Admin Menu Editor Pro plugin, specifically looking for common obfuscation patterns like base64_decode, gzinflate, and str_rot13 combined with encoded payloads.
Detects the creation of an administrator-level user account in a WordPress environment within a one-hour window after the 'Admin Menu Editor Pro' plugin is updated to known trojanized versions (2.35 or 2.36), which is indicative of a backdoor installation.
Detects the creation of files in the /tmp/ directory by common command-line tools (curl, wget, sh, bash), followed shortly by a successful external network connection by the same process from the same device, excluding known benign domains.
This rule detects the creation of a .groovy file within a plugin directory related to JFrog Artifactory, followed by the execution of suspicious child processes (e.g., shell, curl, wget) by the Artifactory process within a short timeframe. This behavior is indicative of an attacker attempting to achieve remote code execution by deploying a malicious plugin.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.
Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.
Page 100 of 340