Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Terraform processes (init or apply) executed in conjunction with suspicious post-deployment indicators, such as references to '.terraform' folders, execution of automation scripts like 'dlp.sh' or 'dlp-docker.sh', or access to sensitive telemetry data external to typical infrastructure management.
Matches known malicious dlp.sh/dlp-docker.sh Terraform module scripts used in Coder registry supply chain attack (common, aider, rstudio-server, windows-rdp, zed variants)
This rule detects process command line arguments that include the string 'data.external.telemetry', which may indicate the use of specialized tools, telemetry collection agents, or unauthorized data exfiltration channels.
This rule detects process command line arguments that include the string 'data.external.telemetry', which may indicate the use of specialized tools, telemetry collection agents, or unauthorized data exfiltration channels.
Detects the presence of a specific sentinel string 'data.external.telemetry' within Terraform provisioner job logs, which indicates the execution of unauthorized data-collection logic within a compromised or backdoored Terraform module.
Detects execution of Coder-related processes or scripts where sensitive configuration parameters, such as database credentials or authentication tokens, are passed via command-line arguments. This behavior can lead to the exposure of credentials to other users or processes on the system through process listing.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
This rule detects the execution of specific DLP-related shell scripts (dlp.sh, dlp-docker.sh) being invoked by Terraform processes. This pattern may indicate suspicious automated infrastructure configuration or an attempt to bypass security controls by leveraging IaC tools to execute scripts.
Detects a hardcoded PEM RSA public key embedded alongside JSCeal-specific compiled V8 bytecode obfuscation artifacts, used to encrypt exfiltrated data or C2 communications
This rule monitors for the execution of Node.js processes involving a file named 'parser.js' and a component or argument referred to as 'ldata'. This behavior is characteristic of specific application workflows, but when observed as a standalone or unusual process, it may indicate unauthorized script execution or the activity of a malicious node-based tool.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Detects the creation or modification of specific files within the /tmp directory, specifically those matching naming patterns associated with 'jasper-log' files or temporary pipe files. These patterns are often associated with temporary storage or data staging activities during post-exploitation or malware execution.
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
Detects the creation or modification of a specific file ('libvirtlog.so.0') located in '/usr/lib/' which acts as a gating mechanism for the curlRAT malware. The detection correlates this file event with processes commonly associated with system management that are executing with command line arguments indicative of malicious activity (e.g., 'reverse', 'pty').
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.
Page 130 of 347