Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the execution of known offensive security and post-exploitation toolsets (such as Impacket, Metasploit, CrackMapExec, or NetExec) when initiated from virtualization processes like QEMU. This pattern is indicative of an adversary executing malicious payloads from within a virtual machine or using virtualization software as a proxy for malicious activity on the host.
Detects the creation of files with extensions commonly associated with web shells (.php, .aspx, .jsp) within typical web application directories by common web server processes such as httpd, nginx, php-cgi, and w3wp. This activity is indicative of a potential web shell deployment for persistent access or command execution.
Detects the simultaneous execution of QEMU virtualization processes and post-exploitation tools (Metasploit, Impacket, Havoc, NXC) on the same host. This combination is indicative of an adversary using a local virtual machine to tunnel or pivot lateral movement activities while leveraging post-exploitation frameworks on the host system, a behavior observed in specific campaigns.
Detects Node.js processes accessing sensitive configuration and credential files such as AWS credentials, .npmrc tokens, SSH keys, and Docker configurations. This behavior is consistent with infostealer activity, including malicious supply chain attacks designed to harvest developer secrets from local filesystems.
Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
This rule detects the installation, service configuration, and key management activities associated with the OpenSSH server on both Windows and Linux environments. It monitors for commands related to installing OpenSSH capabilities or packages, starting the sshd service, modifying SSH registry keys on Windows, creating or modifying configuration files (sshd_config), and updating authorized_keys files. It also flags inbound network connections to non-standard or default SSH ports originating from external IP ranges.
Detects AI coding extensions (e.g., Cursor, Windsurf, Claude) spawning Node.js or Python child processes to execute potential Model Context Protocol (MCP) server configurations located in non-standard, potentially untrusted workspace paths. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-12957, where adversaries leverage MCP to gain unauthorized command execution.
Detects anomalous child process creation, suspicious command-line arguments, or the presence of specific file artifacts associated with the exploitation of heap corruption vulnerabilities in FFmpeg RASC/DLTA codecs (as demonstrated by the exploitarium FFmpeg-RASC-DLTA-calc-poc PoC).
Detects anomalous child process execution from PHP web handler processes (e.g., php-fpm, php-cgi) indicative of exploitation of the StreamBucket SOAP RCE vulnerability. The rule identifies spawning of common shell tools or access to sensitive process memory files (/proc/self/maps or /proc/self/mem) associated with ASLR defeat techniques used in this exploit chain.
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
This rule detects post-exploitation activity related to the exploitation of PHP StreamBucket SOAP deserialization vulnerabilities. It monitors for child process execution from PHP web server processes (e.g., php-fpm, php.exe), the creation of specific proof-of-concept (PoC) marker files, and the presence of identified exploit script filenames on disk.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.
Detects evidence of CVE-2026-48558 exploitation, where SimpleHelp servers fail to cryptographically verify OIDC tokens. This vulnerability allows unauthenticated attackers to create privileged technician accounts and bypass Multi-Factor Authentication (MFA). The rule monitors for 'New Anon' log tags in OIDC authentication flows or unauthorized HTTP POST requests to SimpleHelp technician management endpoints.
Detects anomalous activity consistent with the Velvet Ant 'Operation Highland' methodology, which leverages Nginx/FastCGI to bridge external requests to internal SSH execution. The rule monitors three conditions: 1) HTTP POST requests to internal endpoints containing SSH-related command parameters; 2) suspicious Nginx configuration modifications or reload events; and 3) spawning of SSH processes by FastCGI handlers. Findings are correlated by time and entity to identify potential persistence or lateral movement mechanisms.
Detects outbound network connections to common Tor relay and exit ports (9001, 9050) initiated by processes other than authorized Tor clients. This activity is often associated with threat actors, including Volt Typhoon, using Tor to obfuscate command-and-control (C2) traffic.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects potential Server-Side Template Injection (SSTI) attacks targeting the Flocci API Gateway using Velocity Template Language (VTL). The rule monitors for malicious VTL patterns in network traffic, subsequent OS command execution, anomalous file creation indicating RCE, and IAM scope bypass patterns in cloud environment logs.
Detects Claude or Node-based AI coding agents spawning child processes (e.g., bash, python) to execute commands commonly associated with repository setup, environment configuration, or potential malicious activity (e.g., base64 decoding, network connections, shell spawning). This is intended to identify indirect prompt injection where an AI agent is manipulated into executing unauthorized commands.
Detects multiple failed SSH authentication attempts against a server from a single source within a short timeframe, which is indicative of a brute force password attack.
Page 171 of 347