Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the deletion of files or archives associated with the SHub Stealer malware (specifically /tmp/shub_ directories or /tmp/out.zip) immediately following staging or exfiltration activity within the same process lineage, which is characteristic of anti-forensic cleanup behaviors.
This rule detects password spray attempts against multiple accounts in Cisco ISE device
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
This rule detects the execution of 'pkexec' or 'sudo' by a low-privilege web server process (e.g., Apache, Nginx, PHP-FPM) that results in a process running with root privileges. This pattern is indicative of privilege escalation attempts targeting local vulnerabilities, such as CVE-2021-4034 (PwnKit) or CVE-2021-3156 (Baron Samedit), where a compromised web application account attempts to elevate to root.
Detects npm install/ci/postinstall or publish process activity correlated within a short time window to outbound network connections toward destinations that are not on the known-safe npm registry/CDN allowlist and are not recognized internal mirrors, indicative of malicious npm packages (Shai-Hulud/Miasma) exfiltrating tokens/credentials or beaconing to attacker infrastructure during package install or propagation.
Detects instances where VS Code (Code.exe) or Node.js (node.exe) processes reference CI/CD-related environment variables in their command line. This behavior is often associated with build pipeline manipulation, credential harvesting from environment configurations, or post-exploitation activities within developer environments.
Detects instances where a Java process (typically a web application server like Tomcat) initiates suspicious command-line tools such as cmd.exe, powershell.exe, or various Linux shell binaries, using command-line arguments indicative of a reverse shell or code execution (e.g., -e /bin/sh, -i, /dev/tcp, IEX, DownloadString). This pattern is commonly associated with exploit attempts targeting vulnerabilities like Java deserialization.
Detects VS Code / Node.js extension host processes invoking command lines that reference CI/CD and repository environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URI, Buildkite, CircleCI, Codespace, Gitpod), consistent with malicious Open VSX "evil twin" extensions harvesting developer and CI/CD metadata.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
Cortex XDR Process Lineage Observation
Cortex XDR
This rule monitors and retrieves process lineage information, including child process execution, parent process context, and grandparent process hierarchy for a specific host. It extracts process execution details such as image names and command lines to provide visibility into process trees for forensic investigation and behavior analysis.
Detects non-git processes such as VS Code, VS Code Server, or Node.js reading .git/HEAD or .git/refs files, which may indicate a malicious editor extension harvesting git repository metadata (branch names, commit refs) as observed in the Open VSX 'evil twin' extension campaign.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the ChainDrop/Shai-Hulud 2.0 "Run Copilot" secrets-laundering technique: a CI workflow step dumping toJSON(secrets) to a format-results.txt artifact, followed by GitHub Actions artifact-API downloads using scraped ghs_ runner tokens and git ref deletion used to cover tracks.
Detects the execution of npm, pnpm, or yarn commands used to install or add specific beta releases of the @joyfill/layouts and @joyfill/components packages, which are known to contain malicious code designed to deliver a multi-stage RAT.
Threat actors are exploiting the recently Discovered WordPress Vulnerability. Vulnerability Management platform like defender not fully capable of identifying the vulnerable WordPress Core Application being installed on the organizations Servers. If you are using Defender XDR, here's the KQL to hunt for WordPress Installed Linux and Windows Servers.
Detects Python worker processes (e.g., dataset converters) spawning suspicious child processes (shells, network tools) or accessing sensitive filesystem paths/endpoints, such as Kubernetes service account tokens or cloud instance metadata, which are often indicative of post-exploitation activity following an SSTI or code injection vulnerability.
Page 149 of 347