Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
This rule detects file system artifacts and network activity associated with a malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). The extension utilizes service workers to intercept browser search queries and capture keystrokes, subsequently exfiltrating the data to an attacker-controlled domain.
Detects HTTP requests to Gitea instances containing the X-WEBAUTH-USER header, which facilitates user impersonation when Gitea is misconfigured with 'REVERSE_PROXY_TRUSTED_PROXIES = *' in a Docker environment. This vulnerability (CVE-2026-20896) allows an unauthenticated attacker to impersonate any user, including administrators.
Detects the presence of a malicious Electron-based backdoor disguised as the Franz messaging application, commonly associated with the 'ClickFix' campaign. The rule identifies indicators such as a specific C2 endpoint, automated persistence via Electron login item settings, arbitrary JavaScript execution through a 'task.e' sink, and the creation of local persistence files like 'readme.txt' and 'setup.txt'.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
Detects instances where the Claude Code AI agent or its subprocesses are used to establish persistence. This is achieved by monitoring for crontab modifications or direct writes to SSH authorized_keys files, which are common indicators of post-exploitation activity following an Axiom-style indirect prompt injection.
Detects unusual DNS requests initiated by common development, scripting, and administrative tools (e.g., node, python, powershell, curl) to domains that follow patterns often used for webhooks, relays, or command-and-control services. The rule specifically excludes common package management or source code repositories to reduce noise.
Detects a multi-stage execution chain associated with the 'Contagious Interview' campaign, where Visual Studio Code (Code.exe) spawns a shell process (cmd, powershell, bash, or sh) that uses network retrieval utilities (curl, wget, or http) to download content from known Lazarus group staging domains within a two-minute window.
Detects outbound SSH connections to TCP port 2222 that exhibit specific cipher negotiation patterns (curve25519-sha256 and chacha20-poly1305@openssh.com) associated with a known malicious SSH server exploit scaffold for CVE-2026-55200. This vulnerability involves a pre-authentication heap out-of-bounds write in libssh2 clients.
Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.
Detects anomalous SSH connections originating from internal network appliances or DMZ-segment devices (e.g., storage, firewalls) to multiple internal network hosts. This behavior is indicative of lateral movement or SSH tunneling as observed in the VerdantBamboo BRICKSTORM campaign, where edge devices are leveraged as pivot points.
Detects indicators of persistence on Linux systems, specifically targeting unauthorized cron job creation/deletion in /etc/cron.d/, execution of suspicious shell scripts (ssync.sh), modification of startup scripts (e.g., /etc/rc.d/cron), and execution of binaries from world-writable directories by cron or system daemons. This rule is designed to identify the footprint of known Linux-based persistence mechanisms associated with service account exploitation.
This rule detects the execution of known offensive security and post-exploitation toolsets (such as Impacket, Metasploit, CrackMapExec, or NetExec) when initiated from virtualization processes like QEMU. This pattern is indicative of an adversary executing malicious payloads from within a virtual machine or using virtualization software as a proxy for malicious activity on the host.
Detects the simultaneous execution of QEMU virtualization processes and post-exploitation tools (Metasploit, Impacket, Havoc, NXC) on the same host. This combination is indicative of an adversary using a local virtual machine to tunnel or pivot lateral movement activities while leveraging post-exploitation frameworks on the host system, a behavior observed in specific campaigns.
Detects Node.js processes accessing sensitive configuration and credential files such as AWS credentials, .npmrc tokens, SSH keys, and Docker configurations. This behavior is consistent with infostealer activity, including malicious supply chain attacks designed to harvest developer secrets from local filesystems.
This rule detects the installation, service configuration, and key management activities associated with the OpenSSH server on both Windows and Linux environments. It monitors for commands related to installing OpenSSH capabilities or packages, starting the sshd service, modifying SSH registry keys on Windows, creating or modifying configuration files (sshd_config), and updating authorized_keys files. It also flags inbound network connections to non-standard or default SSH ports originating from external IP ranges.
Detects AI coding extensions (e.g., Cursor, Windsurf, Claude) spawning Node.js or Python child processes to execute potential Model Context Protocol (MCP) server configurations located in non-standard, potentially untrusted workspace paths. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-12957, where adversaries leverage MCP to gain unauthorized command execution.
Detects anomalous child process creation, suspicious command-line arguments, or the presence of specific file artifacts associated with the exploitation of heap corruption vulnerabilities in FFmpeg RASC/DLTA codecs (as demonstrated by the exploitarium FFmpeg-RASC-DLTA-calc-poc PoC).
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.
Page 164 of 341