Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects network connections to known suspicious infrastructure, including specific domains associated with Session, catbox.moe, or targeted npm registry and GitHub API queries initiated by common command-line utilities. This behavior often suggests adversary communication, data staging, or potential tool/malware delivery.
This rule detects the presence of specific file artifacts and directory paths associated with the 'Mini Shai-Hulud' malicious campaign, which involves the compromise of the 'openapi-react-query-codegen' npm package. It monitors for indicators of compromise (IOCs) such as specific malicious JavaScript and shell script filenames, as well as persistence artifacts like plist and service files.
Detects JNDI lookup patterns associated with Log4Shell (CVE-2021-44228) exploitation attempts.
Detects the creation, modification, or renaming of PHP files within the 'wp-content/uploads' directory of a WordPress installation. This pattern is commonly indicative of an attacker uploading a web shell to maintain persistence or execute arbitrary code on a compromised web server.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
This rule detects suspicious process execution originating from web server applications (e.g., php-fpm, apache2, nginx). It looks for common shell interpreters or command-line utilities (e.g., bash, curl, python) triggered by these web server processes when they contain command execution function strings in their command lines (e.g., system, shell_exec, passthru), which is a common indicator of web shell activity or post-exploitation command execution.
Detects the creation, modification, or renaming of PHP files within the 'wp-content/uploads' directory of a WordPress installation. This pattern is commonly indicative of an attacker uploading a web shell to maintain persistence or execute arbitrary code on a compromised web server.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
This rule monitors for internal network connection attempts initiated by the 'mcp-grafana' process to destinations it has not contacted in the previous 14 days. By establishing a baseline of legitimate data source connections, the rule alerts when the process performs a rapid fan-out or discovery against multiple new internal hosts, which may indicate unauthorized network reconnaissance or lateral movement attempts by the Grafana service.
Detects Server-Side Request Forgery (SSRF) attempts targeting vulnerable versions of Grafana MCP Server (versions < 1.1.0). The rule identifies requests attempting to access sensitive internal or cloud-metadata endpoints (e.g., 169.254.169.254, localhost, internal subnets) via the X-Grafana-URL header.
Detects the presence of the 'X_TRACE_' marker within Magento report files or system logs, which is characteristic of the StyleSmuggler threat actor's method of poisoning log files to facilitate subsequent code execution.
Detects the presence of the 'X_TRACE_' marker within Magento report files or system logs, which is characteristic of the StyleSmuggler threat actor's method of poisoning log files to facilitate subsequent code execution.
Detects unexpected child process execution (php, bash, sh) by web server processes (php-fpm, apache, nginx) while accessing specific Magento application directories (var/report, var/log/system.log) or parameters often associated with the StyleSmuggler exploitation technique, indicating potential Remote Code Execution.
Detects unexpected child process execution (php, bash, sh) by web server processes (php-fpm, apache, nginx) while accessing specific Magento application directories (var/report, var/log/system.log) or parameters often associated with the StyleSmuggler exploitation technique, indicating potential Remote Code Execution.
Detects instances where common web server processes (e.g., PHP, Apache, Nginx) spawn child processes associated with command-line utilities (e.g., curl, bash, python). The rule specifically monitors for command-line arguments referencing log files or traces, which is indicative of potential exploitation attempts or post-exploitation activities such as log poisoning or remote code execution.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
This rule detects a high volume of inbound network connection attempts to the default Redis port (6379) originating from local loopback or local host addresses, excluding known legitimate Redis and web server processes. This activity is indicative of potential unauthorized access attempts or exploitation of local Redis instances.
Detects the creation, modification, or renaming of files within directories associated with GVFS (GNOME Virtual File System) or files masquerading as GVFS components. Adversaries often use these paths and file names to stage or hide malicious tools and persistence mechanisms on Linux systems.
Detects the presence of known StyleSmuggler implant binaries (noted as Rust-based implants masquerading as gvfsd-user or kworker) by matching file SHA256 hashes.
Page 133 of 347