Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
Detects suspicious process execution by GitHub Runner.Worker or Runner.Listener on CI runners. It specifically targets the execution of scripts or binaries associated with compromised action components (such as trivy-action or setup-trivy) where version tags have been tampered with to inject credential-harvesting code. The rule monitors for unauthorized command line arguments or file paths linked to these components.
Detects the execution, network activity, or installation of GSocket (gsocket/gs-netcat) tools used for creating remote access tunnels. The rule also identifies instances where the legitimate 'uptime' binary is masqueraded to execute GSocket commands or establish unauthorized network connections.
Detects the creation of a specifically named exfiltration file ('edgeLog.txt') followed by an outbound network connection over port 443 originating from the same process storyline. This pattern is indicative of a process staging stolen data to disk and subsequently exfiltrating it over an encrypted channel to an external destination.
Detects unauthorized attempts to access or extract Redis credentials from the Argo CD repo-server process. The detection identifies suspicious command-line activity where environment variables are enumerated (via env or printenv) or sensitive configuration files (/etc/argocd) are accessed by the repo-server process or its children. This behavior is indicative of an attacker attempting to exploit unauthenticated gRPC vulnerabilities to steal credentials for cache poisoning or further lateral movement within a containerized environment.
Detects TeamPCP-associated behavior in CI/CD environments, specifically the encryption and staging of sensitive secrets using tools like OpenSSL, tar, and curl. The rule monitors for the execution of at least three distinct tools from a specified list within a short time window that interact with files in a /tmp/tmp. staging directory, indicative of preparation for data exfiltration.
Detects suspicious execution patterns on CI/CD runners involving the decoding of base64-encoded payloads piped into sudo python3, which is often used for credential harvesting. The rule identifies this behavior through two methods: sibling process correlation where 'base64 -d' and 'sudo python3' occur within 60 seconds of each other, and the observation of interpreters (sh, bash, python, etc.) launched without arguments in conjunction with runner-specific process patterns, indicative of stdin-piped execution.
Detects package manager lifecycle scripts (npm, yarn, pnpm, composer, go) spawning child processes that perform suspicious activities, including network connectivity (curl, wget) or execution of obfuscated JavaScript (base64/fromCharCode/eval), often indicative of supply chain attacks like the PolinRider campaign.
Detects attempts to perform container escapes or escalate privileges within a Gitea Actions runner environment. The rule monitors for the execution of dangerous container options (e.g., --pid=host, --privileged, --cap-add=ALL) in CI/CD workflow configurations, the spawning of 'nsenter' by the runner process, and writes to sensitive host system paths from containerized processes.
This rule detects the presence and execution of files and scripts associated with the exploitation of CVE-2026-55200, such as harness binaries and proof-of-concept scripts. Additionally, it identifies post-exploitation behavior where common network-related processes (like curl, git, or sshd) spawn suspicious or unexpected child processes, which may indicate successful code execution or lateral movement originating from the compromised service.
Detects anomalous process execution chains originating from the Gitea server or Gitea act-runner processes following the exploitation of CVE-2026-20896. This vulnerability allows an attacker to bypass authentication using a forged X-WEBAUTH-USER header when REVERSE_PROXY_TRUSTED_PROXIES is insecurely configured. The rule identifies subsequent command-line activity such as spawning shells, using network utilities (wget, curl, netcat), or executing Gitea administrative commands by unauthorized child processes.
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
Detects the presence of file system artifacts associated with the malicious Chromium extension 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd) on an endpoint. This extension is known to perform search hijacking and keystroke exfiltration.
Detects unauthorized processes attempting to access sensitive browser data files (Login Data, Cookies, Web Data) that are typically used by web browsers to store credentials and session information. The rule filters out known legitimate browser processes, flagging potential credential theft or session hijacking activity.
This rule detects the exploitation of CVE-2026-48558, a critical OIDC authentication bypass vulnerability in SimpleHelp. The detection logic correlates log events for 'Registering technician login' involving 'New Anon' sessions with subsequent configuration save requests occurring within 30 seconds. This pattern signifies the unauthorized creation of a privileged technician account by an unauthenticated attacker, bypassing standard identity verification.
This rule detects potential phishing activity by correlating emails containing links to a specific suspicious domain and path with network activity (DNS queries or direct network connections) to the same domain. It targets both the initial email delivery and subsequent user interaction (e.g., clicking the link or downloading files).
Detects indicators of exploitation attempts against the CVE-2026-55200 libssh2 heap out-of-bounds write vulnerability. The rule identifies the creation of known PoC artifacts on disk, execution of exploit harnesses or probe binaries, Python scripts masquerading as or interacting with the PoC server, and libssh2-dependent client applications making network connections to the non-standard port 2222 used by the exploit scaffold.
Detects unauthenticated HTTP requests to sensitive Gitea endpoints containing the 'X-WEBAUTH-USER' header set to 'admin'. This rule identifies exploitation attempts against misconfigured Docker deployments where 'REVERSE_PROXY_TRUSTED_PROXIES' is improperly set to a wildcard, allowing unauthorized users to impersonate administrative accounts (CVE-2026-20896).
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
Detects Server-Side Request Forgery (SSRF) attempts using a double-slash URL manipulation technique. Adversaries append an absolute local file path (e.g., /etc/passwd or /proc/self/environ) after a GitHub blob URL to bypass URL validation logic commonly found in web proxies, API gateways, and serverless environments like GCP Cloud Run.
Page 167 of 347