Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation, modification, or renaming of systemd service files within a user's configuration directory (~/.config/systemd/user/). The rule further correlates these file events with the execution of 'systemctl --user' commands to enable or start these services, which is a common pattern for establishing user-level persistence on Linux systems.
The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Detects command-line activity indicative of attempts to disable, bypass, uninstall, or interfere with the Netskope security agent functionality on an endpoint.
Detects potential command injection on GitHub Actions self-hosted runners where a child shell process (bash/sh) is spawned by the Runner.Worker or Runner.Listener processes. The rule looks for a specific pattern of shell command lines containing single quotes, semicolons, and the 'echo' command, which is indicative of a breakout attack exploiting unsanitized GitHub event data (e.g., issue titles) being passed into shell commands.
This rule detects instances of VS Code, code-server, or associated Node.js processes executing 'git config --get user.email'. This behavior is characteristic of malicious VS Code extensions (specifically 'evil-twin' extensions) attempting to perform developer reconnaissance by harvesting local Git identity information, which can then be exfiltrated.
This rule detects the installation of malicious VS Code extensions by monitoring file system writes within common VS Code and VS Code Server extension directories. It specifically alerts on a predefined list of extension namespaces associated with a known malicious coordinated campaign that impersonated legitimate publishers.
Identifies devices with missing or non-compliant Microsoft Defender security controls across Windows, Linux, and macOS endpoints.
The query reviews Microsoft Defender Vulnerability Management (TVM) secure configuration assessments and highlights devices where critical security capabilities are not functioning as expected, including:
Microsoft Defender Sensor
Sensor Data Collection
Defender Communications
Tamper Protection
Real-time Protection
PUA Protection
Cloud-delivered Protection
Security Definitions
Results are enriched with device exposure levels, machine groups, and sensor health status to assist security teams with remediation prioritization.
The query reviews Microsoft Defender Vulnerability Management (TVM) secure configuration assessments and highlights devices where critical security capabilities are not functioning as expected, including:
Microsoft Defender Sensor
Sensor Data Collection
Defender Communications
Tamper Protection
Real-time Protection
PUA Protection
Cloud-delivered Protection
Security Definitions
Results are enriched with device exposure levels, machine groups, and sensor health status to assist security teams with remediation prioritization.
Detects periodic (beaconing) HTTP POST requests directed to '/api/beacon' from endpoints. The detection logic monitors for consecutive connections occurring within a 3-second interval, specifically searching for JSON payloads containing identification fields (id, user, host, pid) characteristic of C2Looper backdoor traffic.
Detects outbound connections to the known Rust supply-chain C2 infrastructure, plus a lower-confidence rule for the broader Hostwinds range on port 9089.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
Detects creation of new scheduled tasks (cron), systemd services, or startup entries that reference the reverse_ssh tool, consistent with attacker persistence established after vCenter compromise.
The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process.
Python's `site` module loads these hooks from directories on `sys.path` before Python is executed.
If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Python's `site` module loads these hooks from directories on `sys.path` before Python is executed.
If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
This rule detects browser-based runtime evaluations that utilize WebRTC's RTCPeerConnection and createDataChannel APIs, often indicative of an adversary attempting to establish a covert command-and-control (C2) channel directly from a compromised browser session.
Detects the execution of native binaries, the creation/modification of Node-API (.node) files, or the loading of .node modules from Visual Studio Code extensions directories. This behavior is indicative of malicious VS Code extensions attempting to execute arbitrary native code for reconnaissance, persistence, or exfiltration.
Detects the execution of various command-line tools (sc, net, powershell, wmic, taskkill, systemctl, launchctl) used to stop or disable system services. This behavior is often associated with adversaries attempting to stop security services, backup agents, or other critical infrastructure for impact, defense evasion, or prior to data destruction.
Detects Mirage2FA phishing stager artifacts by requiring multiple distinctive indicators together: XOR key 0xAD decode chain, LINX*/token placeholders, obfuscator.io _0x naming, api/xls C2 path, iframe injection, and SVG ECMAScript AiTM redirect
Detects the creation of .php files within the wp-content/uploads directory tree by common web server or PHP-FPM processes. This behavior is indicative of an adversary attempting to drop a web shell via file upload bypass vulnerabilities, such as those exploiting MIME-type manipulation.
Detects the use of curl.exe or curl to communicate with the malicious domain 'i.apee.my.id', initiated by a VS Code integrated terminal process. This behavior is indicative of malicious VS Code extensions exfiltrating data via a hidden terminal session.
Detects devices exhibiting sustained high CPU or memory utilization (>= 90%) for a duration of at least 30 minutes, which may indicate resource exhaustion, performance degradation, or potentially malicious activity such as cryptocurrency mining, denial-of-service, or other unauthorized resource-intensive processes.
Detects the botking RAT's C2 beacon: HTTPS POST with the 'i am botking' registration marker and form-urlencoded action=check polling, plus associated TLS/DNS indicators.
Detects a new build-dependencies entry adding a networking crate (ureq/reqwest/rustls) to a Cargo.toml that previously had no such dependency, correlated with a recent Cargo.lock modification, flagging a package gaining unexpected build-time network capability.
Page 143 of 347