Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects network activity associated with the TELEPUZ malware communicating with public Polygon blockchain RPC nodes. The malware interacts with a specific smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E) to resolve its AES-encrypted Command and Control (C2) server address.
Detects instances of 'pip' or 'git' being executed by a Python process to clone or install packages from external sources. This behavior is commonly used to install malicious or untrusted custom nodes within a ComfyUI environment, potentially facilitating initial access or code execution.
This rule detects when a web server process (such as apache, httpd, or php-fpm) modifies or creates a new PHP file within common WordPress directories (plugins or themes). This behavior is often indicative of an attacker attempting to plant a web shell to gain or maintain persistent access to a compromised server.
This rule monitors for suspicious activity often associated with credential or sensitive information discovery in development environments. It identifies: 1) Access to configuration files or directories related to AI-powered development tools (e.g., Cursor, Windsurf, Zed) which may store environment variables or API keys; 2) Network connections to common cloud instance metadata endpoints; and 3) Execution of command-line tools attempting to access AWS secrets or configuration management APIs (Secrets Manager, SSM).
This rule detects various common methods of achieving persistence on Linux and macOS systems. It monitors file system changes to systemd unit files and macOS LaunchAgent plist files, as well as the execution of commands related to managing systemd services and user crontab entries.
Detects instances where the Node.js runtime environment (node.exe) accesses sensitive configuration, settings, or message control protocol (mcp) files within directories associated with common developer IDEs and text editors like Claude, Cursor, Windsurf, Zed, and VS Code. This activity may indicate an attempt to exfiltrate IDE configuration, API keys, or environment settings.
This rule monitors for processes, file names, or command lines that contain the string 'telepuz', which is indicative of a specific malware or malicious toolset. It alerts on any occurrence within process image names, process command lines, or file paths.
Detects attempts to exploit the WordPress wp2shell vulnerability (CVE-2026-63030/CVE-2026-60137) by correlating the identification of a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) via response banners with anomalous Batch REST API requests utilizing the 'author__not_in' parameter.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects HTTP requests to the WordPress REST API batch endpoint carrying User-Agent strings associated with public wp2shell exploitation tooling (wp2shell, cve-2026-63030/1.0, rezwp2shell).
Detects high-volume, threshold-based scanning/exploitation attempts against the WordPress REST API batch endpoint from a single source, consistent with mass wp2shell PoC-driven exploitation.
This rule monitors and aggregates external network connections originating from a specific host. It specifically highlights connections to external domains or IPs that have a low frequency (1-10 connections), which may indicate beaconing activity, command and control (C2) communication, or low-and-slow data exfiltration attempts.
Detects the execution of 'az role assignment list' using the Azure CLI. This command is commonly used by adversaries to enumerate existing role assignments in an Azure environment, aiding in permission discovery and identifying potential targets for privilege escalation.
Detects 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that explicitly include username and password flags in the command line string. This behavior may indicate credential usage for registry authentication.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
This rule detects potentially unauthorized or suspicious developer activity, specifically focusing on the execution of custom scripts like 'temp_auto_push.bat', automated task execution via VS Code 'tasks.json' files, and git commands that bypass security checks using '--no-verify'. These activities may indicate repository tampering, modification of source code integrity, or attempts to automate actions that circumvent established development workflows.
Detects WordPress activity logs involving 'oembed' and 'cache' during a 'parse_request' action. This pattern can be associated with unauthorized attempts to manipulate or exploit the oEmbed cache mechanism within WordPress environments.
Page 158 of 347