Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects unexpected child process execution (php, bash, sh) by web server processes (php-fpm, apache, nginx) while accessing specific Magento application directories (var/report, var/log/system.log) or parameters often associated with the StyleSmuggler exploitation technique, indicating potential Remote Code Execution.
Detects processes named 'kworker' (in bracket notation) that are not initiated by the legitimate 'kthreadd' parent process, which is indicative of a process masquerading as a kernel worker thread. Legitimate kworker processes are kernel threads managed by kthreadd. Processes masquerading as these can be used by malware to hide in plain sight.
This rule detects a high volume of inbound network connection attempts to the default Redis port (6379) originating from local loopback or local host addresses, excluding known legitimate Redis and web server processes. This activity is indicative of potential unauthorized access attempts or exploitation of local Redis instances.
Detects anomalous outbound network connections from the Grafana MCP (Model Context Protocol) server process to internal private IP address ranges. The rule compares current network activity against a 14-day baseline to filter out known data sources, identifying potentially unauthorized lateral movement or internal network probing via server-side request forgery (SSRF) vulnerabilities.
Detects Terraform processes (init or apply) executed in conjunction with suspicious post-deployment indicators, such as references to '.terraform' folders, execution of automation scripts like 'dlp.sh' or 'dlp-docker.sh', or access to sensitive telemetry data external to typical infrastructure management.
This rule detects potentially unauthorized access or attempts to copy sensitive SSH keys (e.g., id_rsa, id_ed25519) by command-line utilities (such as cat, cp, tar, scp, or curl) or when triggered by automation-related process names like 'terraform'. It monitors both process command lines and file events to identify staging or exfiltration activities.
This rule detects unauthorized or suspicious access to sensitive configuration and credential files (e.g., .aws, .azure, .ssh) by specific DLP (Data Loss Prevention) or automation scripts, and identifies subsequent attempts to expose environment variables or sensitive tokens within process command lines.
This rule detects process command line arguments that include the string 'data.external.telemetry', which may indicate the use of specialized tools, telemetry collection agents, or unauthorized data exfiltration channels.
Detects the presence of a specific sentinel string 'data.external.telemetry' within Terraform provisioner job logs, which indicates the execution of unauthorized data-collection logic within a compromised or backdoored Terraform module.
Detects execution of Coder-related processes or scripts where sensitive configuration parameters, such as database credentials or authentication tokens, are passed via command-line arguments. This behavior can lead to the exposure of credentials to other users or processes on the system through process listing.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
This rule identifies potential DNS tunneling or beaconing activity by detecting an unusually high volume of DNS queries (exceeding 50 requests) made to a specific domain name within a given timeframe. Such patterns are often associated with C2 communication or data exfiltration via the DNS protocol.
Detects network connection attempts or established connections to a specific remote IP (103.141.13.26) on UDP port 3479. This pattern is often associated with command and control infrastructure or unauthorized data communication.
This rule detects potentially malicious JavaScript files associated with known malicious patterns or suspicious 'preinstall' script behavior within Node.js environments. It monitors for the execution of specific suspicious filenames or the use of common Node.js package management tools (npm, yarn, etc.) in contexts suggesting code generation or build-time abuse.
Detects the creation or modification of specific dropper/loader files and service worker registration within WordPress directory structures (wp-content/plugins, wp-content/themes, wp-content/uploads). These files are often associated with the injection of malicious scripts (e.g., on-chain resolvers) to facilitate drive-by compromises by site visitors.
This rule detects unauthorized or suspicious access to sensitive configuration and credential files (e.g., .aws, .azure, .ssh) by specific DLP (Data Loss Prevention) or automation scripts, and identifies subsequent attempts to expose environment variables or sensitive tokens within process command lines.
Detects cortex-xdr-payload.exe connecting to a server outside Palo Alto Networks LRC infrastructure. Attackers can abuse the Live Terminal feature as a pre-installed, EDR-trusted C2 channel by redirecting the payload to their own server using a URL validation bypass in the server hostname check
Detects Terraform processes (init or apply) executed in conjunction with suspicious post-deployment indicators, such as references to '.terraform' folders, execution of automation scripts like 'dlp.sh' or 'dlp-docker.sh', or access to sensitive telemetry data external to typical infrastructure management.
Matches known malicious dlp.sh/dlp-docker.sh Terraform module scripts used in Coder registry supply chain attack (common, aider, rstudio-server, windows-rdp, zed variants)
This rule detects process command line arguments that include the string 'data.external.telemetry', which may indicate the use of specialized tools, telemetry collection agents, or unauthorized data exfiltration channels.
Detects the presence of a specific sentinel string 'data.external.telemetry' within Terraform provisioner job logs, which indicates the execution of unauthorized data-collection logic within a compromised or backdoored Terraform module.
Page 121 of 341