Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,627 detections
Filters
Last updated
All Time
Detection languages
1,752
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,489
1,153
779
528
515
Platforms
39,908
7,245
6,529
3,864
3,627
Products / Services
802
512
432
340
298
MITRE Techniques
1,179
573
523
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
This rule monitors for the Node.js process (node.exe or node) accessing common sensitive configuration files, SSH keys, cloud credentials, or environment files such as .ssh/id_rsa, .aws/credentials, .npmrc, and .docker/config.json. Such activity is often indicative of an adversary attempting to perform credential theft or environment discovery after gaining initial access via a compromised Node.js application.
This rule detects the execution of Node.js processes ('node' or 'node.exe') with command-line arguments that match known patterns often associated with software installation scripts, post-installation tasks, or peer verification activities. While these file names can be legitimate, they are also commonly leveraged by attackers for malicious script execution or persistence.
Detects unauthorized access to sensitive cryptographic files, such as SSH private keys, GPG secret keys, or Windows certificate store files, by unauthorized or anomalous processes (specifically node/npm or processes within /tmp). This is followed by potential outbound exfiltration via an external network connection or the mass access of multiple sensitive files within a short timeframe.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
Detects the execution of 'aws sts get-caller-identity' spawned by IDE-related processes such as VS Code extension hosts or Amazon Q language servers. This pattern may indicate cloud credential reconnaissance performed by a malicious MCP (Model Context Protocol) server or compromised development extension (CVE-2026-12957).
Detects command lines that reference known supply chain attack targets or commonly used package management tools like npm and pypi, which can be indicators of supply chain compromise.
This rule detects potential data exfiltration attempts by monitoring for network connections to URLs containing suspicious substrings (bit, onion, .cc, .su) over common web and DNS ports (53, 80, 443, 8080). It flags high-frequency unique connection attempts from a single device, which may indicate command-and-control (C2) traffic or data exfiltration over covert channels.
This rule detects endpoint DNS queries or network connections to the suspected phishing domain 'gasparinutrition.com' initiated by common web browsers or email clients. This provides visibility into potential user interaction with malicious sites that would otherwise be missed by email security gateways.
This rule detects activity associated with the malicious 'Search for perplexity ai' browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). It specifically identifies DNS queries and network connections to the malicious domain 'perplexity-ai.online' initiated by common web browser processes, as well as file system evidence of the extension's presence.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
This rule detects outbound network connections to a specific typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious browser extension designed to intercept and exfiltrate search queries before forwarding them to legitimate search providers.
Detects the creation or modification of an mcp.json file within IDE configuration directories (.vscode, .amazonq), followed shortly by the execution of shell or interpreter processes (bash, sh, cmd, powershell, npx) by the IDE process. This behavior suggests the installation of a malicious Model Context Protocol (MCP) server configuration that could facilitate command execution or persistence within the developer environment.
Detects suspicious child process activity originating from common IDEs or AI language server processes that indicates AWS credential exfiltration. The rule monitors for command-line patterns indicative of credential dumping or exfiltration, such as the use of AWS CLI commands, curl, or npx with the Model Context Protocol (MCP) in conjunction with attempts to access sensitive environment variables or redirect output.
This rule detects potentially malicious child processes spawned by Amazon Q or VS Code language server processes. It monitors for suspicious shell command-line invocations (e.g., bash, sh, cmd.exe) or tools (npx, python) immediately following the activation of language server processes, specifically looking for patterns associated with the unauthorized auto-loading or execution of Model Context Protocol (MCP) configuration files or utilities, potentially related to vulnerability patterns involving workspace-based execution.
This rule detects network activity and email signals associated with a malicious campaign promoting a fraudulent 'Perplexity AI' Chrome extension. It monitors for connections to known malicious Tilda landing pages, correlates these visits with subsequent Google Chrome extension (CRX) downloads within a 10-minute window, and identifies phishing emails containing links to these malicious pages.
Detects the Ghidra reverse engineering suite spawning suspicious child processes such as command shells, scripting interpreters, or network utilities. This activity often indicates an attempt to automate reverse engineering tasks or interact with the system in an unintended manner by potentially malicious scripts or plugins.
Detects potentially malicious activity associated with the Ghidra reverse engineering framework, including the spawning of unexpected non-Java child processes, loading of suspicious project files (.gzf/.gar), loading of unsigned extensions from non-standard directories, and unexpected outbound network connections from decompiler or Java processes.
Detects unauthorized processes (Python, Node.js) accessing sensitive files such as browser login data, cookie stores, wallet files, and SSH/AWS keys, which are common indicators of credential theft and data exfiltration.
Page 103 of 173