Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation or modification of files within the /tmp directory that follow a specific naming convention (t[number]_w.pipe) by an HAProxy process. This pattern is often associated with inter-process communication or potential post-exploitation activity where HAProxy is leveraged to handle named pipes for malicious command execution or data redirection.
This rule identifies a discrepancy between actual network connections processed by HAProxy and the corresponding entries in its server-side logs. Such inconsistencies can indicate the presence of a malicious backdoor compiled into or injected into the HAProxy process, designed to facilitate C2 traffic while evading standard monitoring by suppressing or omitting logging for those connections.
Detects network requests to unpkg.com or npmmirror for 'index.html' files directly under a package path. This behavior deviates from standard package management usage (which typically fetches tarballs or specific JavaScript modules) and is often associated with adversaries using npm packages as hosting infrastructure for phishing landing pages.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
Detects the creation of tar archives within the Coder database during a specific window associated with rogue IP activity, where the file creation was performed by a system-level process.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
This rule detects attempts to modify file or directory permissions (e.g., using icacls, takeown, chmod, or chown) on paths associated with known security products. Such activity is often indicative of an adversary attempting to tamper with, disable, or exclude security tools from logging or inspection.
Detects a sequence of suspicious behaviors on a single host within a 1-hour window, indicative of an adversary establishing a foothold and preparing for malicious activity. The pattern involves: 1) System architecture discovery, 2) Downloading files from an external IP address, 3) Changing permissions of files in temporary directories (e.g., /tmp, /var/tmp, /dev/shm), and 4) Executing files directly from those same temporary directories.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
This rule detects the creation of a .groovy file within a plugin directory related to JFrog Artifactory, followed by the execution of suspicious child processes (e.g., shell, curl, wget) by the Artifactory process within a short timeframe. This behavior is indicative of an attacker attempting to achieve remote code execution by deploying a malicious plugin.
Detects reconnaissance commands (e.g., file listing, directory enumeration) executed as child processes of the JFrog Artifactory service. This behavior is often associated with the exploitation of Artifactory plugins or misconfigured endpoints that allow arbitrary code execution, enabling an attacker to perform discovery actions.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects the registration of browser service workers from suspicious sources. Service workers can be used to maintain persistence, intercept network requests, or perform browser-based man-in-the-middle attacks. This rule specifically alerts on service workers initialized with 'blob:' URIs or those originating from the suspicious 'cdn.bloom.io' domain.
This rule detects processes accessing sensitive credential, configuration, or environment files typically stored in locations like .aws, .ssh, .kube, or application user directories. It alerts when a non-standard or unexpected process touches multiple sensitive folders, or when specific suspicious process names or known malicious tools (such as 'NeedleStealer') are observed interacting with these files. This is indicative of potential credential harvesting or reconnaissance activities.
This rule detects processes accessing sensitive credential, configuration, or environment files typically stored in locations like .aws, .ssh, .kube, or application user directories. It alerts when a non-standard or unexpected process touches multiple sensitive folders, or when specific suspicious process names or known malicious tools (such as 'NeedleStealer') are observed interacting with these files. This is indicative of potential credential harvesting or reconnaissance activities.
This rule detects processes accessing sensitive credential, configuration, or environment files typically stored in locations like .aws, .ssh, .kube, or application user directories. It alerts when a non-standard or unexpected process touches multiple sensitive folders, or when specific suspicious process names or known malicious tools (such as 'NeedleStealer') are observed interacting with these files. This is indicative of potential credential harvesting or reconnaissance activities.
This rule detects processes accessing sensitive credential, configuration, or environment files typically stored in locations like .aws, .ssh, .kube, or application user directories. It alerts when a non-standard or unexpected process touches multiple sensitive folders, or when specific suspicious process names or known malicious tools (such as 'NeedleStealer') are observed interacting with these files. This is indicative of potential credential harvesting or reconnaissance activities.
Page 100 of 347