Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.
Detects when the PostgreSQL service process (postgres.exe/postgres/postmaster) loads a shared library (.dll or .so) from a non-standard, user-writable directory (e.g., Temp, AppData, /tmp). This behavior is indicative of potential exploitation of vulnerabilities like CVE-2026-6471, where attackers attempt to load malicious plugins via unvalidated logical decoding plugin paths.
This rule monitors the software inventory for outdated versions of the PostgreSQL database server. It identifies installations where the major and minor versions are below the threshold for current security releases (e.g., v18 < 6, v17 < 11, v16 < 15, v15 < 19, v14 < 24). Running outdated software increases the risk of exploitation of known vulnerabilities.
This rule detects potentially malicious modifications to PostgreSQL configuration files or the creation of new library files (.so or .dll) by the PostgreSQL service process. It also flags when the PostgreSQL service process is initiated with command-line arguments referencing 'shared_preload_libraries', which can be abused to load arbitrary code or malicious extensions into the database engine.
This rule monitors the software inventory for outdated versions of the PostgreSQL database server. It identifies installations where the major and minor versions are below the threshold for current security releases (e.g., v18 < 6, v17 < 11, v16 < 15, v15 < 19, v14 < 24). Running outdated software increases the risk of exploitation of known vulnerabilities.
This rule detects potentially malicious modifications to PostgreSQL configuration files or the creation of new library files (.so or .dll) by the PostgreSQL service process. It also flags when the PostgreSQL service process is initiated with command-line arguments referencing 'shared_preload_libraries', which can be abused to load arbitrary code or malicious extensions into the database engine.
This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.
Detects direct SQL UPDATE operations on the pg_authid system table to modify privilege flags (e.g., rolsuper, rolcreaterole) without using the authorized ALTER ROLE statement. Such activity often indicates an attempt to escalate privileges or modify database user permissions in an unauthorized manner, bypassing standard auditing and role management processes.
Detects direct SQL UPDATE operations on the pg_authid system table to modify privilege flags (e.g., rolsuper, rolcreaterole) without using the authorized ALTER ROLE statement. Such activity often indicates an attempt to escalate privileges or modify database user permissions in an unauthorized manner, bypassing standard auditing and role management processes.
Detects malicious markdown files (SKILL.md) that impersonate agent instruction files. These files contain hidden-content constructs (like CSS display:none, HTML comments, or invisible Unicode characters) combined with common command execution patterns (like curl, wget, or PowerShell encoded commands), characteristic of infostealer campaigns targeting AI agent platforms.
Detects the execution of the 'chmod +x' command to mark a file named '/tmp/helper' as executable, followed by the execution of that same binary within a 5-minute window. This behavior is indicative of an attacker dropping and executing a payload from a temporary directory.
The following analytic detects exploitation of Ghostscript causing command execution.
This can be used by attackers to abuse file conversion services or embedded LibreOffice documents.
This can be used by attackers to abuse file conversion services or embedded LibreOffice documents.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects files that present a valid PNG magic header at the start but contain embedded PostScript instructions. This pattern is commonly used to exploit vulnerabilities in image processing libraries like Ghostscript or ImageMagick, which may attempt to process the file as PostScript despite the misleading header.
Detects ClickFix-style social engineering attacks where users are lured into executing obfuscated commands via terminal copy-paste. The detection monitors for the sequential execution of remote file downloads (e.g., curl, PowerShell) followed immediately by shell history-clearing commands designed to obfuscate the malicious activity. This behavior is associated with macOS crypto-drainers and loaders.
The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
Detects the execution of Node.js processes where the command line contains the argument 'parser.js'. This is often used by adversaries to execute JavaScript-based payloads or custom scripts for malicious purposes.
This rule monitors for the execution of Node.js processes involving a file named 'parser.js' and a component or argument referred to as 'ldata'. This behavior is characteristic of specific application workflows, but when observed as a standalone or unusual process, it may indicate unauthorized script execution or the activity of a malicious node-based tool.
Detects execution of shell scripts where a remote resource is fetched via curl with silent flags and immediately piped into a shell interpreter. This pattern is commonly associated with the delivery of malicious payloads or installation of unauthorized tools.
Detects the execution of Node.js processes where the command line contains the argument 'parser.js'. This is often used by adversaries to execute JavaScript-based payloads or custom scripts for malicious purposes.
Page 134 of 341