Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,771
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
Detects suspicious system calls by unprivileged users involving unshare, IPsec XFRM policy configuration, and kernel module loading. This specific sequence is used in the DirtyClone (CVE-2026-43503) exploit, which leverages local IPsec tunnels to perform page-cache corruption and modify sensitive system binaries in memory.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Detects high-volume outbound network scanning activity from a single internal source device. The rule identifies anomalous behavior characterized by rapid connection attempts to a large number of distinct destination IPs and ports, consistent with scanning patterns observed in botnets like JDY, which often target edge network infrastructure (Cisco, Ubiquiti, Draytek).
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects CI/CD package manager traffic (e.g., pip, npm) attempting to connect to domains that mimic legitimate PyPI or npm registry domains. This behavior is indicative of a dependency confusion or supply chain attack where an adversary uses typosquatted or phantom-squatted domains to intercept or redirect package requests.
Detects suspicious execution patterns originating from Gitea act_runner that indicate potential container escape attempts or host namespace manipulation. The rule flags the use of sensitive docker flags such as --pid=host, --ipc=host, --cap-add=ALL, and security profile unconfining, alongside the execution of 'nsenter' or the existence of specific proof-of-concept markers related to container escape vulnerabilities.
Detects instances where a Python interpreter (python.exe or python3.exe) initiates an interactive command-line shell (cmd.exe, powershell.exe, bash.exe, or sh.exe). The detection logic further narrows this behavior by looking for common reverse shell indicators such as socket connections or command execution arguments within the process command line.
This rule monitors for file and process events associated with known malicious Chrome extensions. It filters for specific extension IDs embedded within file paths or command-line strings, which typically indicate the installation or activity of malicious browser plugins.
Detects unauthorized HTTP requests to Gitea containing an 'X-WEBAUTH-USER' header set to 'admin'. This targets CVE-2026-20896, where a misconfigured reverse proxy trust setting allows external users to spoof authentication and gain administrative privileges.
Detects instances where a Node.js or NPM process spawns the systemd-userdbd utility. This behavior is highly irregular in standard Linux environments and may indicate an attempt to interact with system user databases, potentially for privilege escalation, persistence, or credential discovery by an application running in the Node.js runtime.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
Detects suspicious child processes (such as shell interpreters or downloader tools) spawned by Langflow, uvicorn, or python processes. The rule focuses on common indicators of post-exploitation activity, including code execution via python arguments, use of curl/wget to pull payloads, and execution of shell scripts often associated with malware droppers.
This rule detects potential exploitation of an out-of-bounds write vulnerability in Python's Pillow library (ImageCms module). It identifies Python processes initialized with indicators related to known exploit research (exploitarium) that subsequently terminate with error signals indicative of a crash, such as heap-buffer-overflows or memory management errors, suggesting successful or attempted exploitation.
Detects the execution of Python-based proof-of-concept scripts related to the Pillow ImageCms out-of-bounds write vulnerability. The rule monitors for Python process execution involving specific file paths associated with the PoC, and correlates this with subsequent process crashes or abort signals which are indicative of an exploit attempt resulting in process instability.
Detects the execution of the 'curl' utility with parameters configured to interact with an SMTP server using 'EXPN' or 'VRFY' commands while loading a configuration file via the '-K' flag. This pattern is indicative of an attempt to exploit CVEs or software vulnerabilities that are susceptible to CRLF injection within SMTP recipient fields, potentially leading to unauthorized mail relaying or protocol manipulation.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
Page 170 of 341