Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
297 detections
Filters
Last updated
All Time
Detection languages
118
41
34
33
20
Contributors
106
38
28
23
20
Categories
167
159
112
48
39
Platforms
231
190
104
9
9
Products / Services
10,680
9,761
6,694
4,418
3,744
297
MITRE Techniques
174
114
60
52
43
CVEs
6
6
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects Python scripts utilizing ctypes, ptrace, or process_vm_readv to perform advanced, programmatic memory scraping without relying on shell utilities. This activity can be indicative of credential dumping or other forms of sensitive data exfiltration from process memory.
Detects the Python interpreter executing with a command line containing a specific string fingerprint ('lzcdrtfxyqiplpd') associated with the Glassworm obfuscation variant. This indicates potential obfuscated code execution.
Detects Python executing a compiled Python file (.pyc) with PySoxy SSL arguments, indicating potential SOCKS proxy activity over SSL.
Identifies the Python loader generating the decryption key using hashlib.sha512 over an embedded parameter.
Detects the execution of Python with the '-remote_port' command-line argument, which is indicative of a SOCKS proxy tunnel being established, potentially by PySoxy or similar tools.
Detects suspicious Python process execution that combines network socket creation with memory manipulation imports (ctypes/mmap) or shellcode-like hex byte strings in the command line. This behavior is indicative of in-memory exploit delivery or staging, often used by adversaries to execute malicious code without writing it to disk. The rule also looks for inline Python execution (-c) with similar indicators.
Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
Detects Python accessing desktop authenticator, token, OTP, or MFA application databases and configuration. This rule specifically looks for Python processes executing with command-line arguments that indicate an attempt to interact with sensitive authenticator application data.
Detects a compiled Python extension writing .py or .pyc files into a temporary or profile directory for later execution. This behavior is often associated with malware that uses Python for its runtime logic, where the compiled Python code (e.g., from Cython) extracts and drops the actual Python scripts for execution.
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Parses Python execution strings to detect inline, on-the-fly decompression and execution of the CastleLoader script without touching disk.
Detects suspicious child processes spawned by Langflow or n8n workflow services, indicating potential unauthenticated Remote Code Execution (RCE) exploitation. The rule specifically looks for these applications (or their underlying node/python processes) spawning common shell processes (cmd.exe, powershell.exe, bash, etc.) which then execute commands typically associated with RCE payload retrieval or execution (wget, curl, Invoke-WebRequest, base64, iex, Invoke-Expression).
Identifies execution of the Python credential stealer script named detect_malware.py, associated with the UNK_DeadDrop phishing campaign.
Detects Python executing a proxy tunnel via the '-remote_ip' argument, which is indicative of PySoxy usage for SOCKS proxying. This activity can be used by adversaries for command and control or data exfiltration.
Detects Python processes accessing sensitive credential paths, a common post-exploitation step for malicious ML models (e.g., CVE-2026-4372). The rule specifically looks for Python executables accessing paths commonly associated with cloud (AWS) or container (Kubernetes) credentials. It includes exclusions for known legitimate ML pipeline scripts to reduce noise.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
Detects the Miasma/Hades langchain-core-mcp malicious Python startup-hook loader
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects Python command lines referencing a specific cryptographic string ('authencesn(hmac(sha256),cbc(aes))') known to be used in the exploitation of the 'Copy Fail' vulnerability (CVE-2026-31431). This string is highly specific and its presence in a Python command line is indicative of an attempt to exploit this particular CVE.
This rule detects the execution of Python processes on Linux systems that include a specific cryptographic template string in their command line. This string, "authencesn(hmac(sha256),cbc(aes))", is indicative of a Proof-of-Concept (PoC) exploit related to CVE-2026-31431, also known as 'Copy Fail'. The detection targets Python binaries (python, python3, or versioned python3.x) and aims to identify attempts to leverage this vulnerability for suspicious cryptographic operations.
Page 11 of 15