Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
297 detections
Filters
Last updated
All Time
Detection languages
118
41
34
33
20
Contributors
106
38
28
23
20
Categories
167
159
112
48
39
Platforms
231
190
104
9
9
Products / Services
10,680
9,761
6,694
4,418
3,744
297
MITRE Techniques
174
114
60
52
43
CVEs
6
6
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects Python processes potentially exploiting CVE-2026-31431 ("Copy Fail") by looking for command-line arguments referencing the 'authencesn' cryptography template or known Proof of Concept script names. This exploits a vulnerability in the AF_ALG socket type and splice() to escalate privileges.
This rule detects the execution of Python interpreters on Linux systems where the command line contains a specific AF_ALG cryptography template. This template is associated with a known vulnerability (CVE-2026-31431) and is considered highly suspicious due to its rarity in legitimate command lines. The detection targets the 'authencesn(hmac(sha256),cbc(aes))' string within the Python command line arguments.
Detects Python processes creating AF_ALG sockets with the 'authencesn' crypto template, which could indicate exploitation of CVE-2026-31431. This rule specifically looks for Python interpreter executions on Linux systems where the command line contains both 'socket.socket(38' (representing AF_ALG family) and 'authencesn'.
Detects the creation of .pth files inside a Python site-packages or dist-packages directory. This technique was leveraged by TeamPCP in the LiteLLM supply chain attack to gain automatic execution every time the Python interpreter was started.
Detects the execution of the specific Linux payload path '/tmp/ld.py', commonly executed via python3 in the background by the dropper associated with the Axios npm supply chain attack.
Detects a Python process attempting to read the memory (`/proc/<pid>/mem` or `/maps`) of a GitHub Actions `Runner.Worker` process. This is indicative of the credential dumping technique used by the TeamPCP threat actor during the Trivy supply chain compromise to extract highly privileged injected secrets.
Detects the execution of a Python stager associated with OmniStealer. The stager uses an inline command to decompress and execute the final payload, a common technique for this malware family.
Detects a Node.js process spawning a Python windowless interpreter (pythonw.exe) from a temporary directory. This unusual process chain is a key indicator of the 'Contagious Interview' infection chain, where a portable Python runtime is dropped and executed.
This rule detects suspicious Python command-line executions that involve importing the 'requests' library, using 'exec()' for dynamic code execution, and making HTTP/HTTPS requests. This pattern is often observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
This rule detects Python scripts that use base64 decoding and execution, specifically looking for the 'import base64' statement appearing early in the file, followed by 'exec(base64.b64decode(' and ').decode('utf-8'))'. This pattern is indicative of a common method for obfuscating and executing malicious Python payloads, often seen in malware like KongTuke.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
This rule detects suspicious Python script execution masquerading as 'svchost.exe'. Specifically, it looks for 'svchost.exe' processes running from a user's profile directory that execute Python code containing 'import', 'requests', 'exec(', and references to 'http://' or 'https://' in the command line. This pattern is indicative of a Python-based malware or script attempting to download and execute additional code, potentially for command and control or further compromise, while trying to blend in with legitimate system processes.
This rule detects suspicious Python script execution via svchost.exe. Specifically, it looks for svchost.exe processes running from a user's profile directory that execute Python commands containing 'import', 'requests', 'exec(', and a URL (http:// or https://). This pattern is indicative of a Python interpreter being used to download and execute malicious code, potentially masquerading as a legitimate svchost process.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects the modification or deletion of specific JavaScript or Python files shortly after a Node.js or Python interpreter starts. This behavior is characteristic of the 'self-patching' and 'evidence removal' techniques used by the Lazarus Group's Graphalgo malware.
Detects the execution of Python scripts associated with the ModeloRAT, such as modes.py, extentions.py, or udp.pyw. This activity is part of the CrashFix campaign, where attackers deploy a portable Python environment to ensure payload execution.
Detects the execution of Python scripts with names associated with the ModeloRAT, often launched from user AppData or Temp directories as part of the CrashFix campaign.
Detects a behavioral sequence where an AI agent runtime (e.g., Node.js, Python) spawns a shell to execute a web request utility like curl or wget. This pattern is a strong indicator of automated data exfiltration, often resulting from a successful prompt injection attack that instructs the agent to steal and send data to an attacker-controlled server.
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Page 12 of 15