Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Node.js processes executing with command-line arguments containing potential GitHub personal access tokens (PAT) or secrets while simultaneously initiating a network connection to the GitHub API. This behavior is indicative of potential credential abuse or automated exfiltration of sensitive tokens.
Detects the use of container inspection tools such as 'dive' or 'docker inspect' to scan image layers or environment variables, specifically targeting the potential exfiltration of credentials or configuration secrets from container images or runtime environments.
Detects outbound network connections to identified infrastructure associated with 'Pink' (CL-CRI-1147) passkey-enrollment vishing campaigns. These operators use phone-based social engineering to direct victims to phishing domains that relay credentials and MFA tokens in real-time to register attacker-controlled passkeys. The rule monitors for specific DNS query patterns containing passkey-related keywords and known malicious IP addresses used by the threat group.
This rule detects instances of the 'su' utility being executed in a manner inconsistent with normal system administration patterns. By filtering out common, expected parent processes (such as login shells, terminal multiplexers, or established system services) and identifying 'su' command-line execution or shell commands attempting to invoke it, the rule flags potentially malicious privilege escalation attempts, such as those exploiting local vulnerabilities.
Detects the execution of the 'encrypter-linux-x86' binary on Linux systems, specifically looking for command-line arguments indicative of file encryption activity (-e or --esxi). This binary name is frequently associated with ransomware targeting virtualized environments.
Detects potential residential proxy usage based on network connections to known proxy-related ports and proxy infrastructure indicators in CrowdStrike Falcon logs.
Detects the creation of specific sensitive file names (AGENTS.md, MEMORY.md, IDENTITY.md, USER.md, SOUL.md) within 30 minutes of a process execution containing email-related keywords (email, mail, inbox). This pattern is often indicative of an adversary staging sensitive information for exfiltration after gaining access to or interacting with an email client or communication tool.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Heuristic detection of high-entropy, obfuscated script content consistent with AI-generated (WormGPT-derived) malware formatted specifically to evade AV/EDR detection tooling
Detects use of 'az acr show' or 'az acr repository list' commands to enumerate Azure Container Registry security settings such as adminUserEnabled, anonymousPullEnabled, or networkRuleBypassOptions, indicating reconnaissance for misconfigurations.
Detects execution of TuxBot v3 multi-architecture ELF binaries, characterized by architecture-specific suffixes (e.g., tuxbot.x86_64) or the presence of the 'Infected By Akiru' banner in command-line arguments. These indicators serve as proxies for identifying this specific LLM-generated bot agent on disk or during runtime execution.
Detects anomalous web server scanning activity where a single source IP performs rapid requests against multiple common administrative or login panel paths (/admin, /wp-admin, etc.) while utilizing randomized ephemeral source ports. This behavior is consistent with automated enumeration scanning, such as that performed by the TuxBot v3 malware.
Detects the execution of 'sudo' or 'systemd-run' with specific flags often associated with automated credential processing or service creation for privilege escalation. The rule monitors for sudo commands using '-S' (read from stdin) and '-p' (custom prompt) flags, which are common in non-interactive scripts attempting to bypass or manipulate password prompts, and systemd-run commands using '--system' and '--no-ask-password', which can be used to run commands as root without interactive authentication.
Detects a native PE or ELF binary masquerading as JavaScript source (e.g. intro.js) dropped in node_modules
This rule monitors for suspicious Git command-line activity that may indicate an attempt to rewrite commit history or force push changes while bypassing verification checks. It detects specific patterns including the execution of 'temp_auto_push.bat', force amending of commits with '--no-verify', and forced pushing with '--no-verify'. These actions are commonly associated with code tampering or the rapid deployment of unauthorized changes to a repository.
This rule identifies AnyDesk remote access software activity by correlating process execution with network connection events between hosts. It tracks the AnyDesk application attempting to establish a network connection within a 5-minute window, effectively monitoring potential interactive remote access sessions across the network.
Detects file access or read operations performed against known password manager database files (1Password, Bitwarden). This activity may indicate an attempt to acquire credentials from local storage.
Detects outbound POST requests using the grpc-web+proto content type where the X-Request-Id header contains a base64-encoded JSON blob. This pattern is associated with exfiltrating sensitive data, such as mnemonic phrases or private keys, to a malicious endpoint masquerading as an Injective testnet gRPC-web node.
Page 153 of 341