Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects network requests to the Gitea Prometheus metrics API that contain 'k=' and 'x=' query parameters, a pattern indicative of a C2 command channel disguised as legitimate telemetry traffic.
Detects network requests to the Gitea Prometheus metrics API that contain 'k=' and 'x=' query parameters, a pattern indicative of a C2 command channel disguised as legitimate telemetry traffic.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects forged NDA documents used in Phantom Deal fake acquisition fraud, requiring corroborating secrecy-clause language and M&A-fraud-specific wire-transfer/payment phrasing alongside impersonated advisory brands
The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections.
Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.
Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects unauthorized database activity targeting Nacos configuration tables, characterized by the use of MySQL's AES_ENCRYPT function to encrypt records, followed by the deletion of original table data or the issuance of a ransom demand. This behavior is indicative of extortion attempts or agentic ransomware targeting web application backends.
Detects unauthorized modification of the Nacos database users table, specifically identifying direct INSERT or UPDATE statements used to plant a backdoor administrative account. The rule correlates database modifications with abnormal authentication patterns, such as a password hash update occurring after a failed login attempt to the Nacos application.
Detects potential database-native ransomware activity by identifying the use of MySQL encryption functions (AES_ENCRYPT) to encrypt records followed by the execution of DROP TABLE commands. This pattern is consistent with extortion techniques where attackers encrypt internal database data and remove original tables.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects the creation of files in the /tmp/ directory by common command-line tools (curl, wget, sh, bash), followed shortly by a successful external network connection by the same process from the same device, excluding known benign domains.
Detects the creation of files in the /tmp/ directory by common command-line tools (curl, wget, sh, bash), followed shortly by a successful external network connection by the same process from the same device, excluding known benign domains.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
This rule detects the creation of a .groovy file within a plugin directory related to JFrog Artifactory, followed by the execution of suspicious child processes (e.g., shell, curl, wget) by the Artifactory process within a short timeframe. This behavior is indicative of an attacker attempting to achieve remote code execution by deploying a malicious plugin.
This rule detects the creation of a .groovy file within a plugin directory related to JFrog Artifactory, followed by the execution of suspicious child processes (e.g., shell, curl, wget) by the Artifactory process within a short timeframe. This behavior is indicative of an attacker attempting to achieve remote code execution by deploying a malicious plugin.
Detects anomalous credential retrieval activity occurring within 30 minutes of a GitLab Duo Chat GraphQL subscription request. This pattern is indicative of potential exploitation of CVE-2026-87719, which involves insecure deserialization within the GitLab EE GraphQL subscription serializer to facilitate unauthorized credential access.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Page 103 of 347