Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects periodic outbound TLS connections over port 443 exhibiting beaconing behavior (5+ established connections with a non-empty SNI from a source host within 300 seconds), consistent with BridgeAgent malware C2 heartbeat/reverse-shell maintenance. Correlate with EDR detections of a process masquerading as /usr/bin/gnome-shell running as root and persisted via a fraudulent zabbix_agent.service.
Detects SSRF attempts targeting cloud metadata endpoints or internal/private network addresses.
Detects access to common authentication/login endpoints.
Detects Linux persistence and removal activity by the botking implant, systemd user-service creation with the 'System Config User Service' description marker, secondary symlink persistence, or systemctl --user enable/disable for install/removal.
Detects the execution of a binary named 'calc-mapping.bin' (either by image file path or command line arguments) where the parent process is 'node'. This pattern is indicative of a Node.js application spawning an unusual or potentially malicious binary.
Identifies devices with software versions affected by CVE-2026-45321 or devices running TanStack related packages identified via vulnerability management and software inventory data.
Detects access to SQL developer tool configuration files (connections.json, product-preferences.xml) followed by a decryption utility, used by CISA's red team to recover cleartext database credentials from a targeted workstation.
Detects the use of common command-line utilities (curl or wget) to download files to a temporary directory (/tmp/helper), initiated from within an interactive shell session (sh, zsh, bash). This pattern is commonly observed during the initial stages of post-exploitation, where threat actors download malicious scripts or tools to a staging directory before execution.
Detects the execution of a file named 'calc-mapping.bin' when invoked directly or through a path, specifically when the parent process is named 'node'. This pattern may indicate the execution of a malicious binary or payload via a Node.js runtime environment.
This rule monitors network connections for traffic directed towards domains and IP addresses associated with a known malicious campaign distributing fake VPN browser extensions, as identified by Socket.dev. These domains and IPs are used for command and control or malicious communication by the browser extensions.
Detects attempts to perform GraphQL introspection or discover schema details by monitoring Caddy web server logs for requests containing common GraphQL-related paths or keywords.
Detects shell metacharacters combined with common OS commands in the request URI.
Detects outbound HTTP traffic indicative of pyCodeVx RAT check-in behavior. The rule identifies communication with ddnsfree.com C2 domains or requests containing the 'pyCodeVx' marker in the URL or User-Agent, coupled with a base64-encoded, fixed-format victim/session ID.
Detects PDF documents that impersonate Notion invitation notifications and incorporate multiple redundant/overlapping URI links. This technique is used by the threat actor DOUBLOON DREDGER to facilitate EvilTokens device code harvesting campaigns.
Detects the presence of known malicious Rust crate archive files (arrayref-0.3.10.crate, proc-macro1-*, and related typosquatted package names) in a host's local Cargo registry cache, indicating the compromised dependency was fetched.
This rule detects when an individual user on a single host launches three or more distinct AI or LLM-related tools (such as ChatGPT, Claude, Cursor, Copilot, Ollama, or LMStudio) within the observed timeframe. This may indicate developers or power users utilizing various AI-assisted coding and productivity tools, but could also indicate unauthorized use of generative AI tools for data processing or exfiltration.
Detects the exact base64-encoded URL fragments used by the malicious proc-macro1 build.rs to obscure the C2 download URL (23.254.165.112:9089) prior to fetching a remote payload.
Detects unexpected child processes spawned by Rust build tools (cargo/rustc) that initiate network connections during build processes. This rule specifically monitors for instances where the build process performs network-related activities associated with build scripts (build.rs) or cargo build commands, which may indicate malicious dependency injection or build-time exfiltration.
Detects suspicious execution patterns in Unix-based shells (sh, bash, zsh) where commands are obfuscated using base64, openssl, or gunzip and then executed via 'eval'. The command further includes indicators of manual execution or persistence, such as 'printf', 'xattr', or immediate permission changes ('chmod +x'). This pattern is frequently observed in the delivery of multi-stage payloads, fileless malware, or initial entry stagers.
Detects the execution of Chrome or Microsoft Edge with remote debugging enabled (--remote-debugging-port) in a headless configuration (--headless=new). This combination is commonly used by automated scripts, scrapers, or potential malicious activity to interact with the browser remotely, which can be leveraged for data exfiltration, session hijacking, or automated attacks.
Detects the Rust rustls custom AcceptAll ServerCertVerifier pattern (all three verify methods returning success unconditionally) used by the proc-macro1 payload to bypass TLS certificate validation when fetching its remote payload.
Page 135 of 341