Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects command-line execution associated with WhatsApp API contact synchronization, specifically looking for 'WPP.contact.getAllContacts' or 'WPP.contact.list' commands. This pattern may indicate automated or unauthorized scraping of contact lists via a messaging interface.
Detects unauthorized file system access to sensitive Gitea configuration files (app.ini) or internal directories (custom/conf, data/tmp) by the gitea/git service account. This pattern is indicative of post-exploitation credential or secret harvesting following remote code execution vulnerabilities, such as the diffpatch git hook RCE (CVE-2026-60004).
Detects outbound network traffic to the 'logfriend[.]com' domain, specifically to endpoints used by the Forg365 'ForgCookie' browser extension. This extension is known to facilitate the automated refreshing of Microsoft SSO cookies, potentially enabling persistent session hijacking and bypassing MFA.
Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.
Detects network connections originating from processes named 'sftunneld' or connections to public IP addresses over specific ports (443, 8305). This pattern is often used to identify potentially suspicious outbound communication, such as tunneling or C2 activity, particularly when observed from non-standard internal processes.
Detects local processes invoking the splice() syscall with the MSG_SPLICE_PAGES flag to map file descriptors of readable SUID-root binaries directly into network socket buffers. This is the core technique behind CVE-2026-31635 (DirtyDecrypt), which corrupts the page cache of SUID-root binaries by placing their pages into attacker-controlled network packets before authentication completes.
Detects anomalous shell processes spawned as children of Git operations ('git apply' with index flags or specific plumbing commands) typical of the Gitea repository RCE vulnerability (CVE-2026-60004). This rule identifies malicious Git hooks triggered by the Gitea service account to execute arbitrary commands.
This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.
Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.
Detects an unprivileged local user invoking keyctl to add a key of type rxrpc_s to a keyring they control, enabling userspace reproduction of the kernel's RxGK token encryption key derivation as part of CVE-2026-31635 (DirtyDecrypt) exploitation.
Detects the SourTrade browser-side build-pipeline setup sequence: a ServiceWorker registered at /sw.js immediately followed, within the same page load, by a SharedWorker instantiated from an in-page Blob URL carrying an application/javascript MIME type — restricted to domains flagged as newly-registered or low-reputation — consistent with the pre-download preparation stage of browser-assembled malware.
Detects execution of a bash reverse shell using /dev/tcp TCP redirection, a persistence/backdoor technique used by TA458 SpyPress operators on compromised webmail servers to connect back to C2 infrastructure.
This rule monitors process command line arguments for strings containing 'maliciousdomain.com'. This pattern is indicative of a process interacting with a known malicious domain, commonly associated with phishing campaigns or initial access attempts where malicious links or payloads are invoked via command-line tools.
Detects a suspicious sequence of events where a browser process (Firefox or Tor) is followed by a process escalation to root within 15 minutes on the same device. This pattern is indicative of a browser sandbox escape combined with kernel privilege escalation (e.g., exploitation of CVE-2026-10702 and CVE-2026-43499).
Detects a suspicious pattern where a process creates a file in /dev/shm/, unlinks it, and re-executes itself from /proc/self/fd/ while manipulating the process name to masquerade as the systemd-journald daemon. This behavior is indicative of fileless execution techniques used by malware to maintain a presence while blending in with legitimate system processes.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects file access/read of the in-cluster Kubernetes service account token path or a user's kubeconfig file by a non-standard binary (e.g. scripting interpreter, shell, or network utility) rather than known Kubernetes/orchestration tooling. Narrowed to reduce false positives from legitimate kubectl, helm, kubelet, and container runtime processes that routinely read these credentials.
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
KQL Query
No description available.
Detects unauthorized processes attempting to access sensitive browser files containing credentials (e.g., 'Login Data', 'logins.json') and cookies (e.g., 'store.json.mozlz4', 'Browser_Cookies.json'). This behavior is commonly associated with credential harvesting malware such as TOKYOCORE, which seeks to steal stored browser secrets before they can be encrypted or for immediate use in session hijacking.
Page 152 of 347