Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects high-frequency, sequential authentication failures across multiple internal targets (SMB/LDAP) initiated from a single internal IP address. This behavior is consistent with credential spraying or lateral movement reconnaissance tools like NetExec or similar automation scripts, often originating from compromised internal assets such as virtual machines.
Detects a highly relevant Antivirus alert that reports a remote access tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This rule detects command-line activity and process execution associated with the exploitation of various Linux kernel vulnerabilities, including CVE-2026-43503, CVE-2026-46300, CVE-2026-43284, CVE-2026-31431, and CVE-2026-43500. It monitors for the compilation and execution of exploit code, manipulation of kernel modules via modprobe for specific network protocols (esp4, esp6, rxrpc), configuration changes to network namespaces (xfrm, unshare), and the presence of known exploit filenames like DirtyClone or DirtyFrag.
This rule detects potentially malicious command execution patterns where shell interpreters (bash, sh, zsh, dash) are invoked to process data piped from suspicious sources. This includes patterns like piping DNS query output (dig) directly into a shell—a technique often used in C2 communication—and base64-encoded payloads executed by shells that originate from or are associated with AI agent tooling (e.g., Claude, Cursor, Cody, Copilot). This behavior is indicative of unauthorized code execution or command and control activity.
Detects suspicious command-line patterns on Linux systems commonly associated with post-exploitation activity, including the establishment of reverse shells, encoded payload delivery via DNS, and manual modifications to crontab or SSH authorized_keys for persistence.
Detects remote code execution exploitation targeting CVE-2026-20253 in Splunk. The rule monitors for unauthorized child processes, such as shells or scripting interpreters, being spawned by the Splunk daemon (splunkd). It also flags processes containing exploit-related strings in the command line as a secondary indicator.
This rule detects processes on Linux systems that masquerade as kernel worker threads (kworker). Legitimate kworker processes are kernel threads initiated by the kernel with no on-disk file path (or a bracketed path). The rule flags processes that have an actual file system path associated with them and are not spawned by the kernel thread manager (kthreadd), indicating potential malicious masquerading.
Detects high-volume outbound network connections (exceeding 10MB) originating from processes associated with AI-driven chatbot or productivity applications (e.g., ChatGPT, Perplexity). This rule identifies potential data exfiltration occurring over legitimate, expected software channels.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
Detects the execution of Node.js where the command line arguments reference a .woff2 font file. This behavior is indicative of an adversary attempting to execute a malicious payload disguised as a legitimate font file, a technique previously associated with the PolinRider campaign.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
Detects the AWS CLI being spawned by processes associated with AI coding extensions (e.g., VS Code extension hosts, Cursor, Windsurf) while executing commands indicative of cloud credential discovery or harvesting (e.g., sts, get-caller-identity, configure export). This activity is indicative of a supply chain compromise or exploitation where an adversary leverages an AI coding tool environment to access cloud credentials stored on the developer's workstation.
Detects anomalous outbound network traffic from Firefox processes indicative of CVE-2025-15661 exploitation. The rule monitors for communication with a specific non-standard port (8765) associated with a SmartWindow PoC server, or requests containing suspicious URI query parameters ('u0', 'u1', 'u2', 'source=history') frequently used for exfiltrating private browsing tabs and history via the '/leak' endpoint.
Detects artifacts, execution patterns, and post-exploitation behaviors associated with the exploitation of the libssh2 heap out-of-bounds write vulnerability (CVE-2026-55200). The rule monitors for the presence of known proof-of-concept files, malicious SSH server orchestration via Python, outbound network traffic to the PoC's default non-standard port (2222) from SSH-capable applications, and post-exploitation shell or calculator spawns.
Detects outbound network connections from common package managers (pip, npm) or utility tools (node, wget, curl) to destinations that are not related to official package repositories or local network ranges. This behavior may indicate an adversary using legitimate tools to download malicious payloads or establish command and control channels.
Detects the presence of malicious Chromium browser extension artifacts related to the 'Search for perplexity ai' extension. This extension abuses Manifest V3 declarativeNetRequest permissions (such as declarativeNetRequestFeedback and declarativeNetRequestWithHostAccess) to intercept and redirect network requests to the attacker-controlled domain 'perplexity-ai.online'. The rule specifically identifies the extension's rule resource files (e.g., perplexity-rules.json) and specific file paths associated with the extension ID.
Detects the execution of setup scripts (e.g., install.sh, Makefile) by shell interpreters that were spawned from common developer-oriented applications (e.g., IDEs, code editors, Python) within a short window after a git clone operation. This behavior is indicative of potential supply chain compromise or malicious project initialization.
Detects known suspicious (default) user-agents related to scanning/recon tools
Detects Node.js processes attempting to access sensitive files or environment variables associated with Claude AI (e.g., Anthropic API keys, .claude configuration files), which may indicate credential harvesting activity by malicious code.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
Page 169 of 347