Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects unauthorized creation or modification of persistent-state files used by AI agents (e.g., AGENTS.md, MEMORY.md). Such files can be poisoned to manipulate the AI agent's objective knowledge or behavior if the content is sourced from untrusted external inputs like email rather than explicit user instructions.
Detects exploitation attempts against Joomla websites targeting CVE-2023-23752. This vulnerability allows an unauthenticated attacker to disclose sensitive information, such as configuration details or user data, by crafting specific GET requests to the Joomla API.
INFO 3AM ransom
YARA
This YARA rule detects files containing specific strings and patterns associated with the 3AM ransomware, such as the group's name, their onion URL format, and common ransomware-related terminology. It is designed to identify ransom notes left behind on compromised systems.
This rule detects processes attempting to open or read files commonly associated with cryptocurrency wallets (Exodus, Electrum, MetaMask) on the endpoint. Unauthorized access to these files is a common indicator of credential theft or attempts to compromise wallet data.
Detects the creation of a crontab entry configured to execute a Python one-liner that performs a network connection to a specific remote IP address on port 4444. This behavior is indicative of a persistence mechanism and a C2 (Command and Control) beaconing attempt.
Detects potential discovery of sensitive information (secrets) within container images by monitoring for the usage of 'dive' targeting private Azure Container Registry images or the use of 'docker inspect' to extract 'Config.Env' combined with 'grep' for the term 'secret'. This activity is often associated with reconnaissance for credential harvesting in containerized environments.
Detects the manual execution of an Azure Container Registry (ACR) task using the 'az acr task run' command. This could indicate an adversary attempting to leverage ACR build capabilities to execute malicious build steps, pull images, or perform unauthorized automation tasks within the container registry environment.
Detects a modified Dockerfile or build script installing netcat and building/pushing a multi-arch image via docker buildx, consistent with backdoored container image creation
Detects the use of 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that include a password passed as a plaintext argument via the '-p' or '--password' flags. This practice exposes credentials in process command-line arguments, which may be visible to other users on the system or logged by security tools.
Detects the creation or modification of persistence mechanisms (Windows Registry Run/RunOnce keys, Cron jobs, Systemd services, and macOS LaunchAgents/LaunchDaemons) that specifically reference Java executables or .jar files. This pattern is consistent with cross-platform malware such as QuimaRAT attempting to maintain persistence.
Detects presence of known-malicious Jscrambler npm supply chain dropper artifact filenames dist/setup.js and dist/intro.js referenced or embedded within scanned content (package contents, tarballs, manifests)
This rule detects the execution of 'node.exe' or 'node' processes that involve specific JavaScript files ('dist/setup.js' or 'dist/intro.js') within the command line arguments or file paths. Such patterns are indicative of potential malicious activity, often associated with the deployment of unauthorized scripts or secondary payloads in a node.js environment.
Detects node.exe processes fetching remote content from specific IPFS dead-drop domains where the executing process does not write a corresponding script file to disk. This behavior is indicative of a fileless execution pattern where a 'caller.js' script fetches a payload and executes it directly in memory using the JavaScript Function constructor, bypassing traditional on-disk detection mechanisms.
Detects attempts to grant world-writable (0666) permissions to the /dev/kvm device node using chmod or setfacl, or unauthorized (non-root) accounts interacting directly with the device. Such configuration changes are associated with the Januscape (CVE-2026-53359) vulnerability, which allows local users to exploit a shadow MMU use-after-free in the kernel to escalate privileges to root or escape into the host from a virtualized environment.
Detects potential LLM prompt injection or jailbreak attempts within command line arguments or event log data, such as instructions to override system prompts or masquerade as a specific persona.
Detects instances where a Unix shell (sh, bash, dash, ash) is spawned by or initiated from the 'ff-agent' process. This pattern often indicates malicious script execution or administrative activity associated with the agent's environment, potentially signaling post-exploitation activity or unauthorized command execution.
Detects Python scripts initiating standard Linux system discovery commands such as id, uname, hostname, ifconfig, ip, or ps. This pattern is commonly used by adversaries for post-exploitation reconnaissance to profile the host environment.
Detects instances where browser-related credential files (Login Data, Cookies, cookies.sqlite) are accessed by processes that are not the associated web browsers. This behavior is indicative of credential theft or dumping, where unauthorized processes attempt to read sensitive browser data to extract stored credentials, cookies, or session tokens.
This rule monitors for the creation or modification of specific files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) that often mimic agent-based collection or configuration files. It specifically identifies when these files are created by processes associated with scheduling mechanisms like 'cron' or 'scheduler', or triggered by a 'heartbeat' event, which is potentially indicative of adversary data collection or staging activity.
This rule detects potential automated data exfiltration or staging behavior by identifying the concurrent execution of email-related processes and vector database memory modification commands (insert/upsert) within a 5-minute window on the same host. This combination may indicate an attacker extracting data from email systems and injecting it into a local vector memory store, likely for subsequent LLM-based analysis or exfiltration.
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
Page 155 of 341