Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
Detects the creation of a file named 'license.tmp' within the '/var/tmp/' directory. This location and filename pattern is often associated with the staging or execution of temporary files, potential persistence mechanisms, or obfuscated payloads commonly found in Linux-based malware or adversary activity.
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
This rule detects when common administrative or networking tools such as bash, sh, cmd.exe, powershell.exe, curl, or wget are initiated by Langflow application processes (python, uvicorn, gunicorn). This behavior is indicative of potential command injection or exploitation of the Langflow platform to execute unauthorized commands or download malicious payloads.
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
An adversary may be leveraging the compromised Visual Studio Code extension nrwl.angular-console-18.95.0 to gain initial access, execute malicious code, or compromise developer environments through trusted VSCode extension installations.
Suspicious Script and Utility Execution
Cortex XDR
This rule detects the execution of common command-line interpreters and utility tools frequently abused by attackers for reconnaissance, execution, and post-exploitation activities. Monitored binaries include script interpreters (python.exe, powershell.exe, pwsh.exe, bash.exe, sh.exe) and command-line utilities (cat, grep, find).
Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.
Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.
Detects repeated Nginx worker process crashes terminated by signals 6 (SIGABRT) or 11 (SIGSEGV) accompanied by core dumps. High-frequency crashes originating from a single source are indicative of an adversary brute-forcing ASLR in preparation for exploitation of memory corruption vulnerabilities (e.g., buffer overflows or heap clobbering) to achieve remote code execution.
Detects instances where an nginx worker process spawns a shell interpreter, such as sh or bash. This behavior is highly irregular for a web server and is often indicative of exploitation of a remote code execution vulnerability, such as the referenced CVE-2026-42533.
Detects exploitation of the CVE-2026-12569 Java deserialization vulnerability in PTC Windchill and FlexPLM. The detection triggers when the specific payload class 'com.ptc.wpcfg.logic.ExpressionClassMethod' is identified within command-line arguments of Java-based processes, indicating an attempt to achieve remote code execution through the application's deserialization flaw.
Matches known Larva-24009 (HeptaX) malicious file hashes
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects network connections originating from processes named 'sftunneld' or connections to public IP addresses over specific ports (443, 8305). This pattern is often used to identify potentially suspicious outbound communication, such as tunneling or C2 activity, particularly when observed from non-standard internal processes.
This query performs comprehensive field extraction and normalization on SentinelOne Deep Visibility raw logs. It acts as a parsing and preparation layer to structure diverse event categories (process, network, file, registry, authentication, and task events) into a standardized format for security analysis, triage, and threat hunting.
Detects anomalous native code execution behavior within Firefox or Tor Browser processes by correlating memory protection changes (e.g., VirtualProtect/mprotect) with subsequent suspicious execution events occurring within a two-minute window, indicative of WebAssembly-based exploit chains.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects post-exploitation persistence and anti-forensic activity associated with the RufRoot/CVE-2026-59726 vulnerability. The rule identifies the creation of unauthorized .js files within application directories, the modification of 'index.js' followed by a SIGKILL to process ID 1 to force a container restart, and attempts to clear bash command history to hide malicious footprints.
Threat actors are exploiting the recently Discovered WordPress Vulnerability. Vulnerability Management platform like defender not fully capable of identifying the vulnerable WordPress Core Application being installed on the organizations Servers. If you are using Defender XDR, here's the KQL to hunt for WordPress Installed Linux and Windows Servers.
Detects command-line execution associated with WhatsApp API contact synchronization, specifically looking for 'WPP.contact.getAllContacts' or 'WPP.contact.list' commands. This pattern may indicate automated or unauthorized scraping of contact lists via a messaging interface.
Page 151 of 347