Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
KQL Query
Detects when AI-integrated IDEs or coding agents spawn sensitive child processes such as command shells (cmd, powershell, pwsh) or web transfer tools (curl, wget). This behavior could indicate malicious activity if an attacker compromises the AI tool or if the tool itself is misused to execute arbitrary commands or exfiltrate data.
This rule detects the execution of processes with filenames starting with 'claude' on server devices. It specifically targets server endpoints by filtering device information to include only 'Server' device types and then joins this with process execution events. This could indicate the presence or execution of AI-related tools or unauthorized software on critical infrastructure.
Detects anomalous file modification or deletion events targeting the SSH known_hosts file. This activity can be indicative of VECT ransomware, which zeroes out this file across compromised Linux and ESXi systems to suppress host-key warnings, enabling silent lateral movement via SCP and SSH.
This rule detects outbound network connections from endpoints to specific, potentially suspicious, IPv4 address ranges (162.220.234.0/24 and 162.220.232.0/24). Such connections could indicate command and control (C2) activity, data exfiltration, or communication with malicious infrastructure.
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
Detects pip or pip3 installation commands targeting the specific compromised version of the elementary-data PyPI package. Installation of v0.23.3 indicates exposure to the supply chain compromise regardless of whether the marker file was subsequently observed. Also catches generic 'pip install elementary-data' without a version pin, which during the active window (2026-04-24 22:20 UTC to 2026-04-25 ~11:51 UTC) would have pulled the malicious version.
Detects DNS requests to file.io originating from non-browser processes, indicative of data exfiltration, potentially by tools like CompactGopher. The rule identifies DNS requests for file.io or its subdomains, joins them with process information, and then filters out common web browsers to highlight suspicious activity.
Identifies active command and control or exfiltration connections associated with the recent AMOS Stealer campaign delivered via AI agents by matching known C2 infrastructure IP addresses.
Identifies active command and control or exfiltration connections associated with the recent AMOS Stealer campaign delivered via AI agents by matching known C2 infrastructure IP addresses.
Detects the execution of the TruffleHog secret scanning tool. This tool is often used by attackers to find sensitive information like credentials in various data sources (filesystems, Git repositories, cloud storage, etc.). This rule identifies the process creation of TruffleHog and categorizes the type of scan being performed. It includes exclusions for legitimate CI/CD environments or security scanners.
Detects copying or writing certificate material and modifications to system keychains. Execution of `security add-trusted-cert`.
This rule detects network connections (both inbound and outbound) on TCP/UDP port 18789, excluding connections initiated by processes from well-known publishers like Microsoft, Apple, and Google. This port is not commonly used by legitimate applications and could indicate the presence of custom malware, command and control (C2) communication, or other unauthorized network activity.
UD Crypt (fudcrypt.net) is a Malware-as-a-Service crypter platform ($800–$2,000/month) that produces polymorphic Windows loaders carrying valid Microsoft-chained Authenticode signatures via Azure Trusted Signing abuse. The signature chains to the "Microsoft Identity Verification Root CA", bypassing SmartScreen and EV-signing checks. The loader abuses DLL sideloading into legitimate signed binaries (Zoom, Slack, VS Code, OneDrive, CCleaner, ProtonVPN, WindowsDF.exe → mpclient.dll), patches AMSI and ETW in-memory, masquerades the PEB as explorer.exe, and beacons via WSS to mstelemetrycloud.com. In a 38-day observation window: 200 operators, 334 builds, 2,093 C2 commands, 32 confirmed victims.
This rule detects the execution of a 'curl' command on macOS that attempts to make a POST request to a file named 'salmonela' within the '/tmp/' directory. This pattern is highly suspicious and could indicate an attempt to exfiltrate data, upload malicious content, or interact with a temporary malicious script.
Detects DNS requests to the known DinDoor and CastleLoader C2 domain serialmenot[.]com, which is a multi-tenant infrastructure used by Iranian APT actors.
This rule detects DNS queries made to a list of known malicious domains. These domains are often associated with malware command and control (C2) infrastructure or other malicious activities. Monitoring such queries can help identify compromised systems attempting to communicate with adversary-controlled resources.
Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.
This rule detects suspicious activity related to a specific IP address (142.11.206.73) in network connections, or a specific domain (sfrclak.com) in DNS requests or process command lines. This could indicate communication with known malicious infrastructure or the execution of malware.
This searches for instances of Trivy, and communicates to the attacker controller server using the domain name and IP address.
Detects curl commands using user-agent strings that Sapphire Sleet uses as campaign tracking identifiers in their macOS intrusion chain. Each stage of the cascading payload delivery uses a distinct UA (mac-cur1 through mac-cur5) to route requests to different server paths serving AppleScript payloads or ZIP archives containing malicious .app bundles.
Page 150 of 174