Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the installation of a specific potentially malicious NPM package ('mouse5212-super-formatter') via the npm command-line interface, followed by the execution of a node process initiated by the npm command within a 5-minute window. This behavior is indicative of a software supply chain attack where a developer or automated process is tricked into installing a backdoored dependency that subsequently executes malicious code.
Detects command-line execution (cmd, powershell, bash, curl, etc.) spawned by SmarterMail, Langflow, or Laravel (Livewire) application processes. This pattern is indicative of remote code execution exploitation, such as CVE-2025-52691 (SmarterMail), CVE-2025-34291 (Langflow), or CVE-2025-54068 (Laravel Livewire), often used to download secondary payloads or perform post-exploitation activity.
This rule monitors for direct execution of Node.js binaries (node.exe or node) where the target script or binary is located within a 'node_modules' directory. By excluding standard file extensions (.js, .mjs, .cjs, .json) and common npm installation command lines, the rule aims to identify potentially malicious or non-standard binaries being executed in a context often used by adversaries for persistence or lateral movement within software dependency environments.
This rule detects potential ransomware activity or bulk file manipulation by monitoring for a high volume of file write, rename, or creation events performed by a single process within a one-minute window. It calculates the frequency and variety of unique files touched to identify potentially malicious automated encryption or data destruction behavior.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects the execution of Java processes with a -jar argument where the JAR file is located in a non-standard, user-writable directory (e.g., Temp, Downloads) and the process is initiated by an unexpected parent application (e.g., shell, explorer). This pattern is indicative of the execution of QuimaRAT or similar Java-based malware.
Detects self-narrating LLM-generated ransomware payload artifacts referencing ransom infrastructure and encryption routines (JadePuffer)
Detects the installation and service creation of the Nezha agent, a monitoring tool often abused by threat actors to establish persistent backdoors on compromised systems.
This rule identifies instances where files are written to the system by processes that lack associated administrative notification or acknowledgment command-line patterns. By joining file-write events with process command-line data, it isolates file creation or write operations performed by potentially unmonitored or non-standard administrative processes, which could indicate suspicious file activity.
Detects the execution of processes where the image name or path contains the string 'werkbit'. This is often associated with the execution of potentially malicious or unauthorized tools.
Detects the creation or modification of cron jobs initiated by processes associated with the OpenClaw or ClawHub platforms. This behavior is indicative of a persistence mechanism being established by these applications, which may be leveraged by attackers if the processes themselves are compromised or malicious.
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
This rule detects potentially malicious database manipulation by monitoring process execution command lines for commands that drop critical databases or toggle foreign key checks. It flags instances where multiple drop database commands occur or foreign key constraint toggling is detected, which is often indicative of automated data destruction or ransomware activity within database environments.
This rule monitors process command lines and file operations for specific strings associated with ransomware, including known ransom note naming conventions ('readme_ransom'), a specific Bitcoin wallet address, a contact email, and SQL commands commonly used to drop database tables for ransom purposes.
Detects execution of gsocket-related tools (gs-netcat, gsocket, gs-sftp) or command-line patterns typically used for remote shell access or socket redirection, such as using -e with a shell, -l/-p for listening, or redirecting I/O from common temporary directories.
Detects build process content (likely within a Dockerfile or CI/CD script) that installs 'netcat' and initiates a multi-architecture build and push operation to a specific container registry path (registryfr.azurecr.io/mongo:latest), which may indicate the creation of a backdoored or malicious container image.
Detects execution of 'npm install' or 'npm ci' commands that explicitly include '@marketfront' or '@tqm-mfe' scopes. This detection is designed to identify potential dependency confusion attacks where malicious actors publish public packages with the same names as internal private packages to trick build systems into downloading malicious code instead of legitimate internal modules.
This rule detects when a user containing the name "admin" in the username fails to log in via SSH.
This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity.
However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity.
However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
Detects iptables INPUT/PREROUTING NAT rule insertions that ACCEPT inbound TCP traffic on a specific port, matching DOGLEASH's deployment script behavior of opening a firewall hole for its backdoor listening port.
This rule detects unauthorized or suspicious access attempts to a MinIO storage service by monitoring network traffic for default credentials, specific API calls like 'ListBuckets', or access to sensitive paths like 'terraform-state'. It triggers when traffic either targets the 'minio.internal' hostname or the local loopback address on port 9000, specifically looking for common MinIO administrative indicators.
Detects execution of processes using 'LOAD_FILE' (often associated with MySQL or specific command-line utilities) to attempt to read sensitive container-related paths such as '/var/run/docker.sock' or '/proc/1/cgroup'. This behavior is indicative of an attacker attempting to gather information for container escape or environment reconnaissance.
Page 157 of 341