Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects node.exe processes fetching remote content from specific IPFS dead-drop domains where the executing process does not write a corresponding script file to disk. This behavior is indicative of a fileless execution pattern where a 'caller.js' script fetches a payload and executes it directly in memory using the JavaScript Function constructor, bypassing traditional on-disk detection mechanisms.
This rule detects attempts to jailbreak Large Language Models (LLMs) by monitoring event logs and process command lines for indicators of 'Prompt Shields' activity. It specifically identifies when a jailbreak attempt is either detected or blocked by security controls.
Detects potential LLM prompt injection or jailbreak attempts within command line arguments or event log data, such as instructions to override system prompts or masquerade as a specific persona.
Detects instances where a Unix shell (sh, bash, dash, ash) is spawned by or initiated from the 'ff-agent' process. This pattern often indicates malicious script execution or administrative activity associated with the agent's environment, potentially signaling post-exploitation activity or unauthorized command execution.
Detects Python scripts initiating standard Linux system discovery commands such as id, uname, hostname, ifconfig, ip, or ps. This pattern is commonly used by adversaries for post-exploitation reconnaissance to profile the host environment.
Detects instances where browser-related credential files (Login Data, Cookies, cookies.sqlite) are accessed by processes that are not the associated web browsers. This behavior is indicative of credential theft or dumping, where unauthorized processes attempt to read sensitive browser data to extract stored credentials, cookies, or session tokens.
This rule monitors for the creation or modification of specific files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) that often mimic agent-based collection or configuration files. It specifically identifies when these files are created by processes associated with scheduling mechanisms like 'cron' or 'scheduler', or triggered by a 'heartbeat' event, which is potentially indicative of adversary data collection or staging activity.
This rule detects potential automated data exfiltration or staging behavior by identifying the concurrent execution of email-related processes and vector database memory modification commands (insert/upsert) within a 5-minute window on the same host. This combination may indicate an attacker extracting data from email systems and injecting it into a local vector memory store, likely for subsequent LLM-based analysis or exfiltration.
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
This rule identifies instances where files are written to the system by processes that lack associated administrative notification or acknowledgment command-line patterns. By joining file-write events with process command-line data, it isolates file creation or write operations performed by potentially unmonitored or non-standard administrative processes, which could indicate suspicious file activity.
This rule monitors network DNS queries for patterns commonly associated with webhook notification services or potential C2 infrastructure. It looks for specifically formatted domains (e.g., 'api.[random]-notifier.[tld]', 'build-notifier' substrings, or custom API subdomains on common cloud-native TLDs) which may indicate the use of webhook services for data exfiltration or adversary command and control.
Detects read, creation, or modification events involving common cryptocurrency wallet files (e.g., wallet.dat) or directories associated with wallet applications (Exodus, Electrum, Ledger Live) located within user application support directories. This behavior is indicative of credential access attempts where an adversary is trying to steal private keys or wallet data.
Detects instances where a Java process (java.exe/java) spawns common network utilities such as FTP, SFTP, or Netcat. This activity is often associated with exploitation of Java-based applications, potentially indicating post-exploitation behavior such as data exfiltration or manual command and control communication.
This rule detects the use of database-related processes (mysql) or scripts (python) interacting with MySQL User-Defined Function (UDF) mechanisms. Attackers often abuse UDFs to execute arbitrary commands, load external libraries, or facilitate lateral movement/privilege escalation within a database environment.
Detects a Node.js process spawning a detached child process that executes a script named 'caller.js'. This behavior is consistent with the 'nodemon-sudo' or 'tslint-conf' supply chain attacks, which leverage detached child processes to execute malicious second-stage payloads while suppressing console output, effectively creating a persistent, hidden backdoor.
Identifies Linux systems acting as KVM hypervisors that are running kernels vulnerable to CVE-2026-53359 (Januscape), a use-after-free vulnerability in the shadow MMU (arch/x86/kvm/mmu/mmu.c). This vulnerability permits a guest virtual machine to escape into the underlying host environment, potentially compromising the hypervisor and other hosted workloads.
This rule detects execution of commands or network traffic containing strings indicative of EDR bypass attempts, obfuscation frameworks, or C2 hosting/infrastructure. This usually signals active adversary efforts to evade defensive controls or setup command-and-control communication.
Detects the execution of processes associated with voice manipulation, voice changing, or 'deepfake' software. These tools may be used by adversaries to facilitate social engineering, impersonation, or to bypass voice-based authentication mechanisms.
These YARA rules detect indicators of compromise (IOCs) associated with a campaign where malicious actors compromised developer accounts to distribute malicious Google Chrome extensions. The rules search for a specific set of C2 IP addresses, domains, extension names, and unique extension IDs known to be part of this supply chain attack.
These YARA rules detect encrypted ZIP archive files that contain exactly one file. Specific variations are provided for ZIP files containing a single .vbs or .msc file. This pattern is commonly used in malware distribution via email to bypass static security controls, requiring user interaction to decrypt and execute the payload.
ROOT SUTERUSU
YARA
This YARA rule detects the presence of Suterusu rootkit source code artifacts, specifically targeting header files, function names, and print strings used for rootkit operations such as process/file/port hiding and module loading manipulation.
Page 162 of 347