Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,771
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects a potential exploitation of CVE-2026-12957, where a malicious git repository contains an MCP (Model Context Protocol) configuration file. When this workspace is opened, the Amazon Q Developer extension for VS Code improperly processes this configuration, resulting in the unauthorized execution of shell processes (cmd.exe, powershell.exe, bash, or sh) by the extension's host processes (code.exe or node.exe).
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
Detects instances where scripting engines (Python or Node.js) access known SSH private key files and subsequently initiate a successful network connection to a non-private IP address within a 60-second window. This behavior is indicative of potential credential exfiltration or unauthorized remote access.
Detects the execution of QEMU processes configured with specific network redirection flags (hostfwd) targeting standard SSH ports, or utilizing suspicious file paths (e.g., .db, .dll) as virtual disk backing files. This behavior is indicative of adversaries utilizing QEMU to establish covert reverse SSH tunnels or staging malicious artifacts within virtualized environments.
Detects potential remote code execution (RCE) attempts targeting Langflow that manifest as the spawning of child shell processes or the execution of curl/wget commands to download and execute malicious scripts (specifically 'isp.sh') from the IP address 83.142.209.214. It also monitors for Python-based execution patterns using 'os.system' to drop or execute these payloads.
Detects anomalous child process creation from typical web and application server processes (IIS w3wp.exe or Openfire Java processes). This behavior is consistent with post-exploitation activity following web application vulnerability exploitation, specifically web shell deployment and execution of reconnaissance or secondary payload staging commands.
Detects the execution of known Command and Control (C2) frameworks such as Sliver, Havoc, SparkRAT, or VShell from common suspicious temporary or staging directories (temp, tmp, appdata, programdata). This rule monitors process creation events to identify the presence of these unauthorized remote access tools.
Detects the use of BPF syscalls by non-root processes or the execution of BPF-related utilities (bpftool, bpfcc) from an interactive shell. This behavior is often associated with the ShadowGuard rootkit and potential BPF-based backdoor activity, which leverages BPF programs for stealthy system monitoring or command execution.
Detects the creation of files with extensions commonly associated with web shells (.php, .aspx, .jsp) within typical web application directories by common web server processes such as httpd, nginx, php-cgi, and w3wp. This activity is indicative of a potential web shell deployment for persistent access or command execution.
Detects execution of unusual preinstall, setup, or GitHub scripts initiated by Node Package Manager (npm) or node processes. This behavior is indicative of a supply chain attack or malicious dependency execution during the installation process of a package.
Detects Node.js, NPM, or NPX processes attempting to read sensitive shell history files (e.g., .bash_history, .zsh_history). This behavior is characteristic of malicious activity such as infostealers attempting to harvest credentials or reconnaissance data from a compromised developer environment, notably observed in supply chain campaigns like the Polymarket Trap.
Detects reconnaissance and exploit activity associated with the BUMSRAKETE exploit (CVE-2026-45257) targeting FreeBSD. The rule identifies system configuration checks of kernel parameters related to kTLS and mbuf external pages, as well as the execution of file permission manipulation commands often required to bypass immutable (schg) file flags during the exploitation process.
Detects indicators of the BUMSRAKETE FreeBSD kernel-level exploit (CVE-2026-45257). This rule monitors for exploit artifact file creation, malicious use of dd to overwrite SUID binaries for privilege escalation, kernel configuration enumeration via sysctl, spawning of shell processes with root UID from suid-related binaries, and kernel version fingerprinting.
Detects evidence of exploitation for CVE-2026-45257, a FreeBSD vulnerability that allows bypassing chflags schg immutable flags. The detection tracks the initial reconnaissance phase where unprivileged processes query the sysctl 'kern.ipc.mb_use_ext_pgs' followed by the creation of specific exploit restorer artifacts '/tmp/.lpe_orig' and '/tmp/.x'.
Detects instances where npm or node processes execute suspicious shell commands or scripts, often associated with software supply chain attacks. The rule looks for child processes like shell interpreters (sh, bash) or utilities (curl, wget, python) initiated by node/npm, combined with suspicious command-line patterns indicative of obfuscated execution or malicious package lifecycle scripts.
Detects the execution, installation, or configuration of Tailscale, a legitimate remote access tool. The rule monitors for common command-line arguments like '--authkey' and 'up', service-related activity, and execution from non-standard file paths. It flags instances where Tailscale is spawned by common script interpreters or command shells, which is a common indicator of unauthorized remote access or C2 implant activity.
Detects the creation of a potentially malicious shared library (libcache.so) in /usr/local/lib followed by a modification of the /etc/ld.so.preload file on Linux systems within a short time frame. This technique is commonly used for persistence and code injection, where the dynamic linker is forced to load the malicious library before others.
This rule monitors for Node.js processes accessing sensitive configuration files, environment files, or credential stores (such as AWS credentials). It also triggers when command line arguments or file contents contain patterns indicative of infostealer activity, including specific indicators related to the Polymarket campaign or credentials collection functions like Git or Docker credential harvesting.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects reconnaissance and exploitation setup activities associated with CVE-2026-46331 (pedit COW). The rule identifies processes enumerating kernel versions via system files or commands, checking unprivileged user namespace capabilities, and configuring network traffic control (tc) filters with pedit actions, which are critical precursors to leveraging the pedit page cache corruption vulnerability.
Page 169 of 341