Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects data exfiltration by the Kynx Stealer ChunkSender module which uses HTTP POST requests to a specific ingestion path.
Detects successful SSH authentication to a Linux system using public-key authentication by monitoring system logs for the 'Accepted publickey for' message. This rule identifies remote access attempts and serves as a foundation for monitoring lateral movement via SSH.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
Detects the creation and enablement of a systemd unit file that uses a deceptive description ('Apache HTTPD Cache Manager') and the 'Restart=always' directive. This pattern is characteristic of persistence mechanisms used by the Evooo1Bot malware, which attempts to maintain continuous execution by running as a system service.
Detects edits to existing Windows, Linux, or macOS endpoint prevention policy rules within Cortex management audit telemetry. These modifications can impact endpoint security posture, necessitating audit and verification to ensure changes were authorized and do not reduce security coverage.
Detects module or image load events where the image lacks an associated on-disk path (FolderPath is empty). This behavior is indicative of in-memory code loading, such as reflective loading or the execution of Beacon Object Files (BOFs), where malicious code is mapped directly into process memory rather than loaded via the standard OS image loader.
Detects HTTP POST requests characteristic of the Kynx Stealer's ChunkSender module. The rule monitors for specific URI patterns used during the exfiltration phase, where stolen data categories like passwords, cookies, and system information are sent to a remote C2 panel.
This rule detects potentially malicious command execution (RCE) originating from AI orchestration platforms and development runtimes (such as Ollama, LangChain, AutoGen, CrewAI, n8n, Node.js, and Python). It flags instances where these processes spawn command shells (cmd.exe, powershell.exe, bash, sh) and execute suspicious command-line patterns indicative of code injection or command execution (e.g., eval(), exec(), subprocess, child_process). The rule uses a threshold of 3 or more occurrences in a 15-minute window per device and process to reduce noise.
Detects a read of /etc/os-release by a binary outside known system-utility paths, a precursor to the Rust-based RAT's host-fingerprinting telemetry; paired with a correlation rule requiring a subsequent outbound connection from the same binary to reduce noise.
Detects command-line activity indicative of attempts to disable, bypass, uninstall, or interfere with the Netskope security agent functionality on an endpoint.
KQL Query
Suricata signature for a Zoom annotation PDU carrying opcode 0x10001 (AddObj) delivered on the downstream acknowledgement channel (which should only carry 0x10002/AddObjAck), indicating sender-role/opcode confusion that lets any participant forge presenter-privileged annotation objects (ZOOMSDAY, CVE-2026-53413/53414/53415).
Detects a Zoom client (zoom.exe/zoom.us/CptHost.exe) terminating abnormally (SIGABRT/SIGSEGV/stack corruption) from within the annotation module (libannotate.so) within 30 seconds of receiving a message-type-75 (CAnnoObjAutoMetaShape) annotation object, indicating exploitation of the linked-list unlink write-what-where primitive (CVE-2026-53415). Excludes update-triggered restarts and graceful shutdowns.
Detects the execution of administrative or system-modifying tools (e.g., bash, sh, chroot, mount) or suspicious command lines involving root-level path manipulation or capability inspection (capsh) initiated by office applications, sandbox host processes, or specialized Excel engines. This behavior is indicative of a potential container breakout, privilege escalation, or post-exploitation activity originating from an initial access vector.
This rule detects potential webshell activity by monitoring the correlation between web server processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, rundll32.exe) and the creation of executable or script files within identified web directories. The logic establishes a high-confidence correlation when both events occur on the same device within a 15-minute window, while also surfacing uncorrelated individual process spawns or suspicious file writes as lower-confidence indicators. It includes exclusions for known administrative and deployment processes to reduce noise.
Linux su Login Shell Invocation
Cortex XDR
Detects the invocation of the 'su' command with a login-shell style argument (e.g., 'su -'), which is used to switch user contexts and potentially elevate privileges.
Detects the creation of new endpoint prevention policy rules for Windows, Linux, or macOS within the Cortex management audit logs. This activity allows security administrators to monitor changes to security posture and endpoint protection configurations.
This rule detects the installation of a new VS Code extension occurring in close temporal proximity to network communication with the official VS Code marketplace or unpkg domains. This pattern is designed to surface potential supply chain compromises where malicious extensions may be deployed to developers' machines.
Cortex Broker VM Collection Error
Cortex XDR
Detects error-classified data collection audit events associated with designated Cortex Broker VMs, identifying collection failures that may interrupt or degrade data ingestion.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
Detects file creation, write, or rename operations to specific paths known to be used in exploitation of CVE-2026-63077.
Page 145 of 347