Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Heuristic detection of high-entropy, obfuscated script content consistent with AI-generated (WormGPT-derived) malware formatted specifically to evade AV/EDR detection tooling
Detects use of 'az acr show' or 'az acr repository list' commands to enumerate Azure Container Registry security settings such as adminUserEnabled, anonymousPullEnabled, or networkRuleBypassOptions, indicating reconnaissance for misconfigurations.
Detects execution of TuxBot v3 multi-architecture ELF binaries, characterized by architecture-specific suffixes (e.g., tuxbot.x86_64) or the presence of the 'Infected By Akiru' banner in command-line arguments. These indicators serve as proxies for identifying this specific LLM-generated bot agent on disk or during runtime execution.
Detects anomalous web server scanning activity where a single source IP performs rapid requests against multiple common administrative or login panel paths (/admin, /wp-admin, etc.) while utilizing randomized ephemeral source ports. This behavior is consistent with automated enumeration scanning, such as that performed by the TuxBot v3 malware.
Detects the execution of 'sudo' or 'systemd-run' with specific flags often associated with automated credential processing or service creation for privilege escalation. The rule monitors for sudo commands using '-S' (read from stdin) and '-p' (custom prompt) flags, which are common in non-interactive scripts attempting to bypass or manipulate password prompts, and systemd-run commands using '--system' and '--no-ask-password', which can be used to run commands as root without interactive authentication.
Detects a native PE or ELF binary masquerading as JavaScript source (e.g. intro.js) dropped in node_modules
This rule identifies AnyDesk remote access software activity by correlating process execution with network connection events between hosts. It tracks the AnyDesk application attempting to establish a network connection within a 5-minute window, effectively monitoring potential interactive remote access sessions across the network.
This rule monitors for suspicious Git command-line activity that may indicate an attempt to rewrite commit history or force push changes while bypassing verification checks. It detects specific patterns including the execution of 'temp_auto_push.bat', force amending of commits with '--no-verify', and forced pushing with '--no-verify'. These actions are commonly associated with code tampering or the rapid deployment of unauthorized changes to a repository.
Detects the use of shell interpreters (sh, bash, zsh) to download content from GitHub using curl (specifically using the -s silent flag) and subsequent base64 decoding of potentially obfuscated payloads using the base64 command with the -D flag.
Detects outbound POST requests using the grpc-web+proto content type where the X-Request-Id header contains a base64-encoded JSON blob. This pattern is associated with exfiltrating sensitive data, such as mnemonic phrases or private keys, to a malicious endpoint masquerading as an Injective testnet gRPC-web node.
Detects potential misuse of an Azure Managed Identity token on a Linux host, where 'curl' is used to interact with the Azure Key Vault API (vault.azure.net/secrets) while presenting an Authorization bearer token. This pattern can indicate an adversary who has obtained a Managed Identity token (e.g., via the Instance Metadata Service) and is attempting to exfiltrate or access sensitive secrets stored in Azure Key Vault.
This rule detects potential ransomware activity by monitoring for high-frequency file rename events (more than 50 in a single dataset aggregation) or file renames resulting in the specific extension '.God8Damn'. Such patterns are highly characteristic of ransomware encrypting local or network files.
Detects a process creating files named 'README.TXT' or 'README.txt' across three or more distinct directories. This behavior is a common indicator of ransomware activity, where an adversary drops ransom notes in multiple folders to maximize visibility after encrypting files.
This rule detects the execution of Java JAR files from suspicious or unconventional directories (such as Temp, AppData, Downloads, or Public folders). It filters out known build tools and CI/CD agents to focus on potentially malicious or unauthorized execution of JAR files that might indicate payload staging or execution in high-risk locations.
Detects the execution of MokManager UEFI binaries or administrative activity via the mokutil utility targeting the MokListX denylist. This activity is indicative of Secure Boot configuration changes, such as enrolling unauthorized certificates or bypassing MOK (Machine Owner Key) denylist enforcement, which can facilitate the persistence or execution of malicious boot-level code.
This rule monitors DeviceFileEvents to detect the installation of a known malicious browser extension, 'VPN Go: Free VPN'. By matching file activity against the extension's unique ID, this detection helps identify potential browser-based threats, such as information stealer functionality or persistent backdoors installed via malicious extensions.
This rule detects potentially unauthorized database manipulation of the 'xadmin' platform, including suspicious administrative role modifications and deletions. It also monitors for suspicious Python script execution involving the 'bcrypt' library, which can be used to generate or verify password hashes in potentially malicious scripts.
Detects instances where the 'Werkbit' process initiates either 'curl' or 'bash' to download files from GitHub-related domains. This behavior is indicative of a living-off-the-land technique used to fetch secondary payloads or scripts during a post-exploitation phase.
Detects outbound network traffic containing the specific string 'Secret: ' using raw TCP, often indicative of data exfiltration or unauthorized command-and-control communication via tunneling tools like netcat or ngrok.
Detects the installation or referencing of the malicious @injectivelabs/sdk-ts package version 1.20.21. This specific version was identified as containing a credential-stealing backdoor disguised within telemetry code.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Page 160 of 347