Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of Node.js processes launched by VS Code (via task runner) that reference known Miasma malware persistence paths (e.g., sync.js in hidden NodeJS directories across Windows, Linux, or macOS).
This rule detects node.js processes that either attempt to read sensitive cloud credential or configuration files (AWS, Google Cloud, Azure) or establish network connections to a specific remote IP address (85.137.53.71) on ports 8080 or 8081. This behavior is indicative of credential theft or potential command and control (C2) activity from a compromised node environment.
Detects recurring kernel panic or oops events on KVM hosts occurring in rapid succession, typically within a 5-minute window. This behavioral pattern is consistent with an attacker repeatedly exploiting a race condition, such as a use-after-free (UAF) in the KVM shadow MMU, to trigger a persistent host denial-of-service.
This rule detects processes being executed that contain 'nacos' and 'token.secret.key' within their command-line arguments. This pattern is indicative of potential attempts to leverage or identify the default JWT secret key for an Apache Nacos deployment, which could allow an attacker to forge authentication tokens and gain unauthorized access.
Detects outbound network traffic containing the string 'Secret: ', which indicates potential sensitive data exfiltration. The rule specifically targets the use of netcat-like behavior directed toward external endpoints, which are commonly associated with tunneling services like ngrok used to bypass network egress restrictions.
Detects reconnaissance activities targeting Azure Container Registry, specifically the listing of available repositories using the Azure CLI and pulling container images, which may indicate an adversary attempting to discover or exfiltrate software components.
Detects execution of common shell interpreters initiated by or containing references to ff-agent.
Detects Node.js processes generating text or log files containing diagnostic markers related to network activity monitoring, such as 'Network Connection Dump Snapshot' or 'Monitoring active egress sockets'. This behavior is characteristic of custom tool execution used for network discovery and data collection on a host.
This rule detects the installation of a specific potentially malicious NPM package ('mouse5212-super-formatter') via the npm command-line interface, followed by the execution of a node process initiated by the npm command within a 5-minute window. This behavior is indicative of a software supply chain attack where a developer or automated process is tricked into installing a backdoored dependency that subsequently executes malicious code.
Detects command-line execution (cmd, powershell, bash, curl, etc.) spawned by SmarterMail, Langflow, or Laravel (Livewire) application processes. This pattern is indicative of remote code execution exploitation, such as CVE-2025-52691 (SmarterMail), CVE-2025-34291 (Langflow), or CVE-2025-54068 (Laravel Livewire), often used to download secondary payloads or perform post-exploitation activity.
Detects the execution of Java processes with a -jar argument where the JAR file is located in a non-standard, user-writable directory (e.g., Temp, Downloads) and the process is initiated by an unexpected parent application (e.g., shell, explorer). This pattern is indicative of the execution of QuimaRAT or similar Java-based malware.
Detects the execution of a file named 'intro.js' by the Node.js runtime located within a 'node_modules' directory. This pattern is often associated with the execution of suspicious scripts, persistent backdoors, or malicious packages that attempt to masquerade as standard dependencies.
This rule monitors for direct execution of Node.js binaries (node.exe or node) where the target script or binary is located within a 'node_modules' directory. By excluding standard file extensions (.js, .mjs, .cjs, .json) and common npm installation command lines, the rule aims to identify potentially malicious or non-standard binaries being executed in a context often used by adversaries for persistence or lateral movement within software dependency environments.
This rule detects potential ransomware activity or bulk file manipulation by monitoring for a high volume of file write, rename, or creation events performed by a single process within a one-minute window. It calculates the frequency and variety of unique files touched to identify potentially malicious automated encryption or data destruction behavior.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects self-narrating LLM-generated ransomware payload artifacts referencing ransom infrastructure and encryption routines (JadePuffer)
Detects the installation and service creation of the Nezha agent, a monitoring tool often abused by threat actors to establish persistent backdoors on compromised systems.
Detects the execution of processes where the image name or path contains the string 'werkbit'. This is often associated with the execution of potentially malicious or unauthorized tools.
Detects the creation or modification of cron jobs initiated by processes associated with the OpenClaw or ClawHub platforms. This behavior is indicative of a persistence mechanism being established by these applications, which may be leveraged by attackers if the processes themselves are compromised or malicious.
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
Detects a Node.js process termination followed by a quick respawn of a new Node.js process by the same parent process. This pattern suggests a watchdog persistence mechanism where the parent process monitors the child, automatically restarting it if it is terminated, consistent with behaviors observed in malware such as Void Dokkaebi.
Page 163 of 347