Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects suspicious execution patterns associated with the SleeperGem supply chain attack, where a compromised Gem install script (git_credential_manager-2.8.3/bin/install) spawns shell or PowerShell commands to trigger secondary malicious scripts like deploy.sh or redirects output to /dev/null.
Detects SleeperGem RubyGems supply chain artifacts: hardcoded Forgejo C2 reference in gem Ruby source, the git-credential-manager binary dropped under the hidden gcm path, and supporting deploy.sh/persistence indicators (ping6 backdoor, systemd/cron service under the git-credential-manager name)
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
Detects the creation of an app-specific password named 'ZimbraWeb' using the CreateAppSpecificPasswordRequest SOAP command in Zimbra logs. This technique is used to maintain persistent access to mailboxes while bypassing multi-factor authentication (MFA).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects HPC GPU and SLURM reconnaissance (nvidia-smi/squeue) run together or spawned from a Python parent process, consistent with the mrmustard stealer's environment-profiling behavior.
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects anomalous SOAP requests to 'GetScratchCodesRequest' within the 'zimbraSync' or 'zimbraAccount' namespaces in Zimbra logs. This activity is indicative of credential harvesting attempts, specifically the exfiltration of 2FA recovery scratch codes, often associated with the ZimReaper/Ulej payload used by threat actors.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects HTTP traffic patterns characteristic of suo5 and Neo-reGeorg web shell tunnels. These tools facilitate bidirectional communication through JSP endpoints (e.g., /jmx/suo5.jsp, /common/themes/top_css.jsp) by utilizing hardcoded proxy identifiers in HTTP headers. This behavior is indicative of a compromised web server acting as a pivot point for command-and-control operations.
Detects high-frequency requests to WordPress REST API batch endpoints, which are commonly used in automated exploitation or scanning attempts against WordPress installations. An unusual volume of these requests from a single client IP within a short time window is a strong indicator of unauthorized probing or exploit activity.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Detects PHP process execution invoking fsockopen() to establish an outbound reverse shell connection, consistent with SpyPress backdoor persistence mechanisms deployed by TA458 on compromised Roundcube webmail servers.
Detects processes accessing files within a user's ~/.ssh directory, excluding standard files like known_hosts and .pub files. This pattern is characteristic of malware attempting to exfiltrate SSH private keys, similar to the behavior observed in the mrmustard stealer.
Detects the keylog_start/keylog_stop C2 command schema with active-window-title capture used by ChonkyChicken's keylogging capability.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects attempts to exploit the WordPress wp2shell vulnerability (CVE-2026-63030/CVE-2026-60137) by correlating the identification of a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) via response banners with anomalous Batch REST API requests utilizing the 'author__not_in' parameter.
Detects PHP files and their containing directories that follow the wp2shell_<hex> naming convention under WordPress wp-content subdirectories (plugins/upgrade/uploads), as dropped by the wp2shell WordPress Core RCE chain (CVE-2026-63030 / CVE-2026-60137). Requires the strict wp-content/<plugins|upgrade|uploads>/...wp2shell_<8-hex> path structure rather than any new plugin directory creation, to avoid flagging legitimate plugin installs. Correlate with process-creation telemetry confirming a web-server process (e.g. apache2) as the creator of the matched path.
This rule detects potentially malicious activity on WordPress servers by correlating the creation of a new administrator account via the REST API with subsequent plugin installation activity and the creation of PHP files within the plugin directory within a one-hour window. This sequence is characteristic of an adversary establishing persistence or backdooring a WordPress site after gaining unauthorized access.
Detects SSH private key file access by scripting interpreters while excluding legitimate SSH/git tooling, matching the mrmustard stealer's SSH key theft behavior.
Page 147 of 341