Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects anomalous outbound network traffic from Firefox processes indicative of CVE-2025-15661 exploitation. The rule monitors for communication with a specific non-standard port (8765) associated with a SmartWindow PoC server, or requests containing suspicious URI query parameters ('u0', 'u1', 'u2', 'source=history') frequently used for exfiltrating private browsing tabs and history via the '/leak' endpoint.
Detects outbound network connections from common package managers (pip, npm) or utility tools (node, wget, curl) to destinations that are not related to official package repositories or local network ranges. This behavior may indicate an adversary using legitimate tools to download malicious payloads or establish command and control channels.
Detects the presence of malicious Chromium browser extension artifacts related to the 'Search for perplexity ai' extension. This extension abuses Manifest V3 declarativeNetRequest permissions (such as declarativeNetRequestFeedback and declarativeNetRequestWithHostAccess) to intercept and redirect network requests to the attacker-controlled domain 'perplexity-ai.online'. The rule specifically identifies the extension's rule resource files (e.g., perplexity-rules.json) and specific file paths associated with the extension ID.
This rule detects potentially malicious command execution patterns where shell interpreters (bash, sh, zsh, dash) are invoked to process data piped from suspicious sources. This includes patterns like piping DNS query output (dig) directly into a shell—a technique often used in C2 communication—and base64-encoded payloads executed by shells that originate from or are associated with AI agent tooling (e.g., Claude, Cursor, Cody, Copilot). This behavior is indicative of unauthorized code execution or command and control activity.
Detects the execution of setup scripts (e.g., install.sh, Makefile) by shell interpreters that were spawned from common developer-oriented applications (e.g., IDEs, code editors, Python) within a short window after a git clone operation. This behavior is indicative of potential supply chain compromise or malicious project initialization.
Detects known suspicious (default) user-agents related to scanning/recon tools
Detects Node.js processes attempting to access sensitive files or environment variables associated with Claude AI (e.g., Anthropic API keys, .claude configuration files), which may indicate credential harvesting activity by malicious code.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects the execution of the GS-Netcat network utility with flags characteristic of reverse shells (e.g., -e, -i, -S, -D) in conjunction with the creation of a systemd service unit file on the same host, which is a technique used by the Velvet Ant threat actor for persistence.
This rule identifies web requests containing path traversal sequences (such as '..', '..%2f', or null bytes) or attempts to access sensitive system files (e.g., 'etc/passwd', 'proc/self/environ') within URL query parameters. The rule normalizes different URL query fields and applies regex matching to detect common encoding bypass techniques used to exploit web applications.
This rule detects processes on Linux systems that masquerade as kernel worker threads (kworker). Legitimate kworker processes are kernel threads initiated by the kernel with no on-disk file path (or a bracketed path). The rule flags processes that have an actual file system path associated with them and are not spawned by the kernel thread manager (kthreadd), indicating potential malicious masquerading.
Detects unauthorized file write or rename operations targeting core OpenSSH binary and library paths, excluding known package manager activities. This behavior is indicative of an adversary replacing legitimate system binaries to create a trojanized version of OpenSSH, as observed in the Velvet Ant 'Operation Highland' campaign, used to harvest credentials and log SSH sessions.
Detects an attacker-controlled SOCKS5 proxy masquerading as the Samba daemon (smbd) by renaming the process to 'smbd' and executing it with the '-D' flag from non-standard filesystem locations such as /tmp, /home, /var/tmp, or /dev/shm. This behavior is associated with the Velvet Ant threat group, which uses this technique to maintain persistent command-and-control communication while evading detection by blending in with legitimate system processes.
Detects suspicious file creation activities by system authentication processes (e.g., sshd, su, sudo, PAM) in known staging directories (/tmp, /var/tmp, /dev/shm) or SSH configuration paths. The rule looks for hidden files or files with specific extensions (.log, .dat, .bak) often associated with malicious backdoored components used to intercept and store credentials in plaintext.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
Detects HTTP POST requests containing multipart form data that include suspicious PHP functions commonly associated with webshells, such as eval(), base64_decode(), system(), or passthru(). This indicates a potential attempt to upload or execute a malicious PHP script on a web server.
Detects artifacts, execution patterns, and post-exploitation behaviors associated with the exploitation of the libssh2 heap out-of-bounds write vulnerability (CVE-2026-55200). The rule monitors for the presence of known proof-of-concept files, malicious SSH server orchestration via Python, outbound network traffic to the PoC's default non-standard port (2222) from SSH-capable applications, and post-exploitation shell or calculator spawns.
Detects anomalous process execution chains originating from Gitea or Gitea Act Runner processes. This rule is designed to catch post-exploitation behavior associated with CVE-2026-20896, where an improperly configured reverse proxy allows an attacker to impersonate an administrator. The detection identifies shells, scripting interpreters, and network utilities spawned by the Gitea service, which may indicate command injection, malicious git hook execution, or CI/CD job abuse following an unauthorized administrative access.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
Page 163 of 341