Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects activities related to Tampermonkey (a popular browser extension for userscripts) or interactions with paste.sh, often used for hosting scripts or payloads. The rule monitors both process-level executions and network requests for these indicators, which may be associated with malicious script execution or browser-based credential or session theft.
This rule detects the use of command-line text-processing utilities (grep, awk, sed, etc.) to search for sensitive credential-related strings (e.g., secret, token, password) within environment files or process environments. This pattern is indicative of an adversary attempting to manually extract stored credentials from configuration files or system environment variables.
Identifies the creation or modification of files within /etc/cron.d that exhibit suspicious naming conventions, including references to syslog, .log extensions, 59310, or known filenames such as zz-poc59310-syslog.log. The rule is intended to detect potential abuse of the cron scheduling mechanism for persistence, particularly where attackers disguise cron entries as legitimate log files to evade detection.
The following analytic detects the use of download or file reading utilities from Windows, Linux or MacOS to download or read the contents of a file from a remote or local source and pipe it directly to a shell for execution.
This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions.
This activity is significant as it is commonly associated with malicious actions like coinminers and exploits such as CVE-2021-44228 in Log4j.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.
This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions.
This activity is significant as it is commonly associated with malicious actions like coinminers and exploits such as CVE-2021-44228 in Log4j.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects instances where LiteLLM, or related Python application processes (uvicorn, python), spawn a shell or command-line utility (bash, sh, id) under the root user account. This behavior is indicative of potential container breakout, application exploitation, or privilege escalation attempts originating from a web-accessible service.
Detects the malicious NFe-themed ZIP dropper MOTOROLA_MOB_COM_NFe_2026-07-16_21781624.zip by known hash and archive structure
Detects the malicious NFe-themed ZIP dropper MOTOROLA_MOB_COM_NFe_2026-07-16_21781624.zip by known hash and archive structure
Detects Server-Side Request Forgery (SSRF) attempts against Grafana instances using the 'X-Grafana-URL' header. The rule identifies requests attempting to access internal network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254, localhost) via the Grafana MCP interface, particularly when non-GET HTTP methods are used to potentially mutate internal resources.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
This rule monitors for internal network connection attempts initiated by the 'mcp-grafana' process to destinations it has not contacted in the previous 14 days. By establishing a baseline of legitimate data source connections, the rule alerts when the process performs a rapid fan-out or discovery against multiple new internal hosts, which may indicate unauthorized network reconnaissance or lateral movement attempts by the Grafana service.
Detects the creation of a PostgreSQL replication slot using an unrecognized or potentially malicious logical decoding plugin. Adversaries may use custom or unauthorized plugins to exfiltrate database contents or intercept replication data streams, bypassing standard monitoring for common plugins like pgoutput or test_decoding.
This rule detects potentially malicious modifications to PostgreSQL configuration files or the creation of new library files (.so or .dll) by the PostgreSQL service process. It also flags when the PostgreSQL service process is initiated with command-line arguments referencing 'shared_preload_libraries', which can be abused to load arbitrary code or malicious extensions into the database engine.
Detects anomalous activity originating from PostgreSQL processes, including the spawning of shells (cmd, powershell, sh, bash), access to sensitive files (e.g., /etc/shadow, SSH keys), and file creation outside the standard PostgreSQL data directories, which is consistent with the abuse of SQL functionality like pg_read_file() or lo_export().
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
Detects when the PostgreSQL service process (postgres.exe/postgres/postmaster) loads a shared library (.dll or .so) from a non-standard, user-writable directory (e.g., Temp, AppData, /tmp). This behavior is indicative of potential exploitation of vulnerabilities like CVE-2026-6471, where attackers attempt to load malicious plugins via unvalidated logical decoding plugin paths.
Page 114 of 341