Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects instances where LiteLLM, or related Python application processes (uvicorn, python), spawn a shell or command-line utility (bash, sh, id) under the root user account. This behavior is indicative of potential container breakout, application exploitation, or privilege escalation attempts originating from a web-accessible service.
Detects instances where LiteLLM, or related Python application processes (uvicorn, python), spawn a shell or command-line utility (bash, sh, id) under the root user account. This behavior is indicative of potential container breakout, application exploitation, or privilege escalation attempts originating from a web-accessible service.
Detects cmd.jar, a JAR-based command executor used by threat actors on compromised Cisco Secure FMC to run arbitrary shell commands via /bin/sh -c
Detects exploitation attempts against the WordPress LiteSpeed Cache plugin (CVE-2024-28000), including suspicious web requests involving ESI/crawler cookie hash manipulation, execution of known exploit binaries (wp28000, wp28000_cp), and subsequent unauthorized creation of administrator accounts via the WordPress REST API.
This rule detects administrative SQL statements (ALTER ROLE, CREATE ROLE, or GRANT) that assign the REPLICATION attribute to a database role. The REPLICATION attribute in PostgreSQL allows a user to initiate streaming replication and perform logical decoding. This is a security-sensitive privilege, as users with this attribute can potentially bypass standard access controls or, if the environment is misconfigured or vulnerable (e.g., CVE-2026-6471), potentially leverage malicious replication plugins to achieve arbitrary code execution.
This rule detects attempts by users to disable or clear command line history logs for shell environments, including PowerShell (e.g., modifying PSReadLine history) and Unix-like shells (e.g., unset HISTFILE, setting HISTSIZE to 0, or disabling history collection). Such actions are frequently performed by adversaries to hinder incident response and forensic analysis by obscuring their post-exploitation activity.
Detects command-line execution of tools (route, netsh, sysctl) intended to modify host routing tables or enable IP forwarding. Such activity on workstation endpoints may indicate an attempt to bridge network segments, bypass network security boundaries, or facilitate lateral movement/C2 communications.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Detects the execution of a Java JAR file (specifically cmd.jar) that is initiated by a shell process (sh). This behavior may indicate an attempt to run malicious Java-based payloads or secondary scripts through a command-line interface.
This rule detects administrative SQL statements (ALTER ROLE, CREATE ROLE, or GRANT) that assign the REPLICATION attribute to a database role. The REPLICATION attribute in PostgreSQL allows a user to initiate streaming replication and perform logical decoding. This is a security-sensitive privilege, as users with this attribute can potentially bypass standard access controls or, if the environment is misconfigured or vulnerable (e.g., CVE-2026-6471), potentially leverage malicious replication plugins to achieve arbitrary code execution.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects direct SQL UPDATE operations on the pg_authid system table to modify privilege flags (e.g., rolsuper, rolcreaterole) without using the authorized ALTER ROLE statement. Such activity often indicates an attempt to escalate privileges or modify database user permissions in an unauthorized manner, bypassing standard auditing and role management processes.
This rule monitors Syslog entries for PostgreSQL 'CREATE_REPLICATION_SLOT' commands to identify potential exploitation attempts associated with CVE-2026-6471. It detects attempts to load logical decoding plugins using suspicious path structures, including path traversal sequences ('../', '..\'), absolute paths, or UNC paths, which are not present in a known-good allowlist of plugins.
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Page 16 of 51