Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
Detects rapid access (three or more distinct files within a 60-second window) to sensitive files typically containing credentials or configuration data (e.g., SSH keys, AWS credentials, environment files, container configurations). This pattern is often associated with credential dumping or reconnaissance activity by an adversary attempting to harvest secrets.
This rule detects HTTP/1.1 requests containing an Upgrade header (specifically targeting WebSocket upgrades) accompanied by a non-zero Content-Length header. This pattern is characteristic of a request smuggling primitive targeting the nghttpx reverse proxy, where the provided body may be misinterpreted by the backend as a separate, smuggled request due to improper request queue handling.
Detects a suspicious sequence of events involving the creation of an .amazonq/mcp.json file shortly after a git clone operation, followed by an AI coding assistant (Amazon Q, VS Code, Cursor, Windsurf) spawning runtime interpreters (node, npx, python). This behavior aligns with potential exploitation attempts against AI-assisted development environments, such as CVE-2026-12957, where malicious configuration files are used to trigger unauthorized code execution.
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
Detects the spawning of potential Model Context Protocol (MCP) server processes immediately following or by package installation commands (npm, pip). This behavior is characteristic of malicious packages or typosquatted dependencies attempting to register or execute a malicious MCP server configuration upon installation in a developer environment.
This rule monitors for file system activity associated with the 'libpwn' exploit suite, specifically targeting files related to the exploitation of CVE-2026-55200. It flags the presence of exploit harnesses, probes, and proofs of concept (PoCs) identified by specific filenames and directory structures.
Detects execution of Node.js processes associated with the TaskWeaver JavaScript loader. The rule monitors for unauthorized Node.js processes (lacking official publisher signatures) spawning secondary processes or executing specific suspicious command lines linked to TaskWeaver and Djinn Stealer activity, such as loading obfuscated jquery.js or accessing configuration files associated with credential theft.
This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.
Detects artifacts, execution of harness tooling, and post-exploitation behavior associated with CVE-2026-55200 in libssh2. The rule monitors for the presence of known exploit filenames (libpwn), suspicious Python script execution, unexpected shell spawning from SSH-enabled clients, and outbound network connections to non-standard ports typical of exploit scaffolding.
Detects Claude or Node-based AI coding agents spawning child processes (e.g., bash, python) to execute commands commonly associated with repository setup, environment configuration, or potential malicious activity (e.g., base64 decoding, network connections, shell spawning). This is intended to identify indirect prompt injection where an AI agent is manipulated into executing unauthorized commands.
Detects instances where AI coding agents, specifically Claude or Node-based environments, initiate secondary processes like git clone, package installation (pip, npm), or script execution. This behavior often suggests the agent is autonomously pulling and executing code from external repositories without explicit human approval, posing a significant risk of supply chain compromise.
Detects instances where a non-root user executes the 'sudo' command in combination with 'tee'. This pattern is frequently used to bypass file permission restrictions by appending or writing content to sensitive system files that would normally require root privileges, a common method for privilege escalation or maintaining persistence.
This rule detects the modification or creation of sensitive Linux files often used for persistence, such as cron job configurations, system boot scripts, and custom system tools. It monitors for file writing and process execution events involving specific paths and filenames identified as associated with persistence mechanisms or monitoring tools.
This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.
Detects potential privilege escalation and unauthorized file modification by the 'egnyteservice' account. The rule monitors Syslog for sudo usage involving the 'tee' utility with 'NOPASSWD' configuration, or suspicious writes to critical system directories such as /usr/sbin/ and /etc/cron.d/, which are indicative of VerdantBamboo threat actor activity on edge appliances.
Detects Python processes spawned by development tools (VSCode, Cursor) or Node.js that are engaged in suspicious activities, specifically communicating with the Telegram Bot API or uploading large amounts of data, often accompanied by file staging (ZIP archive creation). This behavior is characteristic of the InvisibleFerret information stealer.
Clipboard hijacking malware for cryptocurrency address substitution
Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.
Detects anomalous SSH daemon (sshd) activity characterized by the installation or execution of a non-standard sshd binary (often located in /tmp or /var/tmp) or the execution of sshd with suspicious command-line arguments (custom ports or custom configuration files), followed by modifications to the authorized_keys file. This behavior is indicative of unauthorized persistence or backdoor access.
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
Page 166 of 341