Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects potential data exfiltration (CVE-2026-42824) where an attacker leverages an SSRF vulnerability in Bing's search-by-image functionality to relay sensitive M365 Copilot data. The rule identifies outbound network requests to the image search endpoint containing a suspicious 'imgurl' parameter pointing to non-Microsoft infrastructure, initiated by common web browser processes.
This rule detects network connections or DNS queries originating from common web browsers (chrome.exe, msedge.exe, chromium.exe) towards domains related to Perplexity AI. Such activity may indicate data exfiltration or the use of AI tools for processing sensitive organizational data via browser-based interfaces.
Detects the presence, file creation, or execution of known proof-of-concept (PoC) scripts, binaries, and directories associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability.
Detects the execution of npm install commands that include known malicious package names associated with a supply chain attack linked to the Lazarus Group. These packages are designed to impersonate the legitimate 'rollup-plugin-polyfill-node' package.
Detects potentially malicious activity involving MySQL processes, specifically focusing on the creation of files within the /var/lib/mysql-files/ directory, use of SQL 'INTO OUTFILE' for file output, or the use of 'LOAD_FILE()' to read sensitive system files like /etc/hostname or /proc/1/mountinfo, often indicative of SQL injection exploitation or unauthorized data access.
Detects the execution of command lines containing suspicious keywords associated with potential data encryption, database table destruction, or configuration tampering. These commands, such as those invoking encryption functions or dropping configuration tables, are indicative of malicious activity often performed by ransomware or wiper malware to hinder system recovery or exfiltrate and destroy data.
This rule monitors outbound network connections from internal hosts to specific ports associated with database management (MySQL: 3306) and service orchestration/discovery (Nacos: 8848, 9848). It aggregates connection counts and distinct target IP addresses by source host and initiating process. High volumes of connections to these specific service ports from unexpected processes may indicate unauthorized discovery, brute-force attempts, or lateral movement.
Detects signs of a supply chain attack, specifically referencing the IronWorm/Shai-Hulud pattern, involving the backdating of git commits, manipulation of git environment variables (GIT_COMMITTER_DATE/GIT_AUTHOR_DATE) to mask malicious activity history, and the use of 'touch' commands to modify file timestamps on project-related binaries and configuration files.
Detects the invocation of script interpreters (python, bash, powershell, etc.) initiated by package management utilities (pip, npm, gem). This pattern is often indicative of supply chain attacks, automated malicious script delivery, or post-exploitation activity where legitimate development tools are abused to execute encoded or obfuscated commands.
Detects browser search traffic being hijacked to the typosquatted domain 'perplexity-ai.online' by the malicious Chromium extension 'Search for perplexity ai'. The rule monitors for network connections to the malicious domain and the presence of extension-related file artifacts on the system. The extension utilizes chrome_settings_overrides to redirect browser Omnibox queries and exfiltrate user search activity to attacker-controlled infrastructure.
Detects the execution of known network exploitation tools like Responder.py or MultiRelay.py, as well as unauthorized processes binding to ports used for LLMNR (UDP 5355) and NBT-NS (UDP 137), which are classic indicators of potential adversary-in-the-middle attacks.
Detects post-compromise persistence techniques, including crontab modifications, SSH authorized_keys updates, and systemd service creation, when performed by child processes of AI agentic tools like Claude, Node.js, or Python. This activity suggests malicious persistence establishment following an indirect prompt injection or supply-chain compromise of the AI agent environment.
Detects AI agent processes (e.g., claude, node) executing environment enumeration commands (env, printenv) following suspected prompt injection, combined with subsequent network traffic associated with credential exfiltration patterns.
Detects instances where a shell interpreter (bash or sh) accesses sensitive cloud and environment configuration files, specifically when initiated by parent processes associated with IDE-integrated development tools or AI assistants (claude, cursor, copilot-cli). This behavior suggests potential unauthorized access to credentials or environment variables.
Detects MCP (Model Context Protocol) server processes or developer tools spawned by IDE extensions performing environment variable enumeration to access cloud credentials (e.g., AWS, Azure, GCP, GitHub tokens) followed by anomalous outbound network connections, indicating potential exfiltration of sensitive developer environment secrets.
Detects the use of the 'docker cp' command with suspicious path traversal characters or known PoC artifacts in the destination parameter. This behavior is indicative of an attempt to exploit path traversal vulnerabilities in the Docker daemon (such as those allowing container escape) by writing files outside the container's intended scope onto the host filesystem.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
Detects the creation of unrecognized Go-compiled binaries by common developer tools (e.g., node.exe, code.exe) in user-writable or temporary directories, followed shortly by outbound network connections to known C2 infrastructure (e.g., vercel.app, jsonkeeper.com). This behavior is consistent with the 'Contagious Interview' campaign attributed to the Lazarus Group.
Detects evidence of exploitation attempts related to the hypothetical CVE-2026-55200 vulnerability. The rule monitors for known exploit file names, command-line arguments, and specific network patterns targeting SSH ports (22, 2222) that indicate potential LibSSH2 exploitation.
Detects exploitation attempts against the Flowise Model Context Protocol (MCP) environment, specifically targeting the node_options case-sensitivity bypass (CVE-2026-20182). The rule monitors for malicious node child process spawning, command line injection via the --require flag, suspicious file creation (flowise_marker.txt), and unauthorized outbound network connections from the Flowise process.
Detects indicators of the DirtyClone (CVE-2026-43503) Linux kernel local privilege escalation exploit. The rule identifies the execution or compilation of the PoC binary, the specific su invocation used for shell spawning by the exploit, and subsequent post-exploitation actions including modifying sensitive files (/etc/passwd, /etc/sudoers) and creating new local accounts with sudo privileges.
Page 168 of 347