Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Threat actors are exploiting the recently Discovered WordPress Vulnerability. Vulnerability Management platform like defender not fully capable of identifying the vulnerable WordPress Core Application being installed on the organizations Servers. If you are using Defender XDR, here's the KQL to hunt for WordPress Installed Linux and Windows Servers.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects creation of a VS Code/Open VSX extension folder whose name reuses a known legitimate vendor namespace (AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, US government) but is published at an implausibly low version (0.0.1 or 0.0.2), matching the 'evil twin' extension-confusion pattern.
Detects the deployment and execution of GSocket-based persistence mechanisms on Linux systems. This includes monitoring for the use of deployment scripts (gs_deploy.py, gs_persist.py), the establishment of cron jobs for periodic GSocket check-ins, the use of GSOCKET_HOST environment variables to control network behavior, and the execution of GSocket binaries staged in suspicious locations such as /tmp/.gs or web server directories.
Detects the creation of a file named 'license.tmp' within the '/var/tmp/' directory. This location and filename pattern is often associated with the staging or execution of temporary files, potential persistence mechanisms, or obfuscated payloads commonly found in Linux-based malware or adversary activity.
Detects a multi-stage exploitation chain for CVE-2026-15410 targeting SonicWall SMA 1000 appliances. It correlates web request logs containing path traversal sequences in a hotfix parameter, associated application log entries indicating removal of a hotfix referencing a temporary file, and subsequent system shutdown commands executed with root privileges, indicating successful privilege escalation and system compromise.
This rule detects when common administrative or networking tools such as bash, sh, cmd.exe, powershell.exe, curl, or wget are initiated by Langflow application processes (python, uvicorn, gunicorn). This behavior is indicative of potential command injection or exploitation of the Langflow platform to execute unauthorized commands or download malicious payloads.
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects potential exploitation of CVE-2026-59726 (RufRoot) against the Ruflo MCP bridge service. The rule identifies when the 'node' or 'ruflo' processes spawn shell interpreters (sh, bash) with command-line arguments typical of initial reconnaissance (id, hostname, whoami, uname) or arbitrary command execution, indicative of an unauthenticated remote code execution attempt.
Detects incoming web requests (via URI queries or form data) containing common OS command injection characters, shell metacharacters, or command execution patterns indicative of attempts to execute unauthorized commands on the underlying web server.
Detects the execution of Chromium-based browsers (Chrome, Edge, Brave, Chromium) using command-line arguments '--load-extension' or '--disable-extensions-except'. These flags are typically used for development purposes but are abused by attackers to sideload malicious, unpacked extensions, bypassing the browser's extension store review process and enabling techniques such as credential theft or C2 persistence.
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
Detects deletion, modification, or renaming of the Chrome 'passkey_enclave_state' file by a process other than Chrome. This file contains sensitive wrapped identity, User Verification (UV) private keys, and security domain secrets. Unauthorized access or deletion of this file is indicative of an attempt to force Chrome to re-onboard the device, which may expose key material during the re-registration flow.
Detects HTTP POST requests to an Apache Tomcat server containing a Java serialized-object header (AC ED 00 05) in a request body larger than 512 bytes, consistent with CVE-2026-34486 deserialization exploitation.
Detects the execution of the 'clientCode' RAT process when initiated by a Node.js process (node.exe/node). This behavior is indicative of a second-stage payload execution related to supply chain compromises where malicious dependencies are leveraged to gain remote shell access.
Detects unauthorized modifications to the core npm CLI entry point file (cli.js). Adversaries may modify this file to inject malicious code, achieving persistence or executing unauthorized commands whenever the npm tool is invoked.
Detects unauthorized POST requests to the '/Windchill/login/' directory targeting .jsp files. This path is not used by legitimate PTC Windchill/FlexPLM traffic and is indicative of an adversary attempting to interact with a webshell or exploit a vulnerability such as CVE-2026-12569.
Detects Node.js processes executing code from compromised Joyfill beta packages (@joyfill/layouts or @joyfill/components). The rule triggers when a Node.js process attempts to load specific files or interact with file paths associated with these packages, which are indicative of an attempt to bypass standard installation security measures (like --ignore-scripts) and execute malicious code during package import.
Page 150 of 347