Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,769
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects HTTP requests to the WordPress REST API batch endpoint carrying User-Agent strings associated with public wp2shell exploitation tooling (wp2shell, cve-2026-63030/1.0, rezwp2shell).
Detects high-volume, threshold-based scanning/exploitation attempts against the WordPress REST API batch endpoint from a single source, consistent with mass wp2shell PoC-driven exploitation.
Detects the execution of 'az role assignment list' using the Azure CLI. This command is commonly used by adversaries to enumerate existing role assignments in an Azure environment, aiding in permission discovery and identifying potential targets for privilege escalation.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
This rule monitors and aggregates external network connections originating from a specific host. It specifically highlights connections to external domains or IPs that have a low frequency (1-10 connections), which may indicate beaconing activity, command and control (C2) communication, or low-and-slow data exfiltration attempts.
Detects 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that explicitly include username and password flags in the command line string. This behavior may indicate credential usage for registry authentication.
Detects WordPress activity logs involving 'oembed' and 'cache' during a 'parse_request' action. This pattern can be associated with unauthorized attempts to manipulate or exploit the oEmbed cache mechanism within WordPress environments.
This rule detects when a web server process (such as apache, httpd, or php-fpm) modifies or creates a new PHP file within common WordPress directories (plugins or themes). This behavior is often indicative of an attacker attempting to plant a web shell to gain or maintain persistent access to a compromised server.
Detects a single host rapidly initiating outbound Telnet (port 23) or SSH (port 22) connection attempts against a large number of distinct remote IP addresses in a short window. This behavior is indicative of bot-agent scanners, such as those associated with IoT botnets, attempting to propagate by performing brute-force login attempts using default credential pairs.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
This rule detects potentially unauthorized or suspicious developer activity, specifically focusing on the execution of custom scripts like 'temp_auto_push.bat', automated task execution via VS Code 'tasks.json' files, and git commands that bypass security checks using '--no-verify'. These activities may indicate repository tampering, modification of source code integrity, or attempts to automate actions that circumvent established development workflows.
This query hunts for suspicious cases where Warp Terminal or a Warp-related parent process spawns Unix-like shell interpreters such as sh, bash, zsh, fish, or dash, and executes commands using shell execution patterns like -c, /bin/sh, sh -c, or bash -c. It detects suspicious post-condition behavior consistent with exploitation attempts for CVE-2026-48703 and CVE-2026-48731
Detects the loader-pool.db PNG-format file used to smuggle encrypted payload modules inside IDAT chunks, reassembled after a sleep-based evasion delay
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects telemetry consistent with GigaWiper's command 8 'route manager' function, which binds or unbinds targeted routing keys against a RabbitMQ 'Topic' exchange using a mode of operation (1/2/3) to enable non-broadcast, targeted command delivery over AMQP C2 channels.
Detects Node.js processes spawning child Node.js processes where the command line references known IPFS gateways, the 'sync.js' script name, or specific Content Identifiers (CIDs) associated with Miasma malware or related decentralized distribution activity.
Detects process command lines using curl to query the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) for OAuth tokens. This behavior is indicative of an attacker attempting to leverage an Azure Managed Identity associated with a compromised virtual machine to obtain temporary security tokens for unauthorized access to other Azure resources.
Page 152 of 341