Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects artifacts and activity related to the exploitation of CVE-2026-55200 in libssh2. The rule monitors for the creation or execution of identified libpwn exploit harness files and scripts, as well as suspicious network activity involving TCP port 2222, which is the default port for the PoC rogue SSH server. It also correlates the appearance of these exploit files with subsequent outbound SSH connections.
Detects attempts to perform container escapes by abusing the 'docker cp' command. The rule identifies path traversal sequences in 'docker cp' arguments, as well as unauthorized shell or script execution spawned by container daemon processes (e.g., dockerd, containerd) following a file copy operation, and specific file creation patterns indicative of a container escape attempt.
This rule detects suspicious activity on Linux systems including unauthorized modification of SSH authorized_keys, creation of unauthorized system accounts (e.g., 'troot'), manipulation of critical system files like /etc/passwd or /etc/shadow, and the execution of specific suspicious scripts or commands indicative of an exploit or post-exploitation activity.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
Detects malicious activity associated with the exploitation of StreamBucket PHP vulnerabilities. The rule monitors for unexpected child processes spawned by PHP/web server processes, the creation of specific exploitation artifact files in /tmp, unauthorized reading of /proc/self memory files by PHP, and inbound SOAP-related HTTP requests.
Detects reconnaissance and post-exploitation activity associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability. The rule identifies the execution of known libpwn PoC binaries, libssh2-dependent client applications (curl, git, php) spawning unexpected shell processes, and unauthorized access to SSH-related configuration or key files by non-interactive processes.
This rule detects potentially malicious command-line execution patterns aimed at harvesting sensitive credentials. It monitors for the access or searching of configuration files (e.g., AWS, .env, or Github tokens) and the dumping of environment variables that likely contain API keys or secrets, specifically targeting services like AWS, Anthropic, and GitHub.
This rule detects potential credential harvesting activities by monitoring for suspicious environment variable enumeration or unauthorized access to sensitive credential and configuration files (such as AWS credentials and .env files) by common command-line utilities. It is designed to identify post-compromise reconnaissance where an adversary attempts to extract cloud provider or AI API keys.
Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.
Detects the exploitation of a vulnerability in the SimpleHelp OIDC authentication flow where an attacker can register a forged technician account and self-register MFA during the first login, effectively bypassing mandatory multi-factor authentication requirements. The detection looks for specific sequences in server logs involving OIDC attribute fetching and 'New Anon' technician registration tags.
Detects instances where the 'pg_dump' database utility is executed, followed by the deletion of a file within a one-hour window by the same agent. This behavior is indicative of an attacker extracting sensitive database contents and subsequently attempting to remove evidence of the dump or staging files.
Detects high-frequency execution of MySQL enumeration queries (such as showing databases, tables, or selecting from the information_schema) by the MySQL client process. This behavior is often associated with database reconnaissance or automated scanning during the discovery phase of an attack.
Detects the execution of 'aws sts get-caller-identity' combined with 'curl' operations utilizing stdin data piping, often associated with unauthorized identity enumeration and data exfiltration in cloud-native environments, particularly when initiated from developer tool contexts like Amazon Q/MCP configurations.
Detects modifications to Chrome or Chromium browser preference files that indicate either the installation of a specific malicious extension or the overriding of the default search provider to a known suspicious domain (perplexity-ai.online). This indicates potential browser-based persistence or search hijacking.
Detects the execution of AWS CLI commands typically used for cloud resource enumeration (e.g., listing users, roles, buckets, or identity information) when spawned by common development environments, IDEs, or shell interpreters. This rule is designed to identify potential post-exploitation activity where an attacker uses compromised developer credentials or environments to map the cloud infrastructure.
Detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a legitimate 'Perplexity AI' extension. This malware hijacks the browser's default search provider to redirect traffic to 'perplexity-ai.online'.
This rule identifies network activity or DNS queries associated with the known malicious domain 'perplexity-ai.online'. It monitors both endpoint network event logs and DNS logs to alert on any attempts to establish communication with or resolve this specific domain.
Detects the execution of known MyBB 'Limited ACP to Admin' proof-of-concept scripts via common python interpreters and identifies suspicious child process spawning behavior from typical web server applications (such as nginx, apache2, and php-fpm). This activity is indicative of post-exploitation attempts or web shell execution via injected plugins or templates.
This rule detects the execution of Docker containers or related CI/CD runner processes (like Gitea act_runner) with insecure configuration options. These options, such as --privileged, --pid=host, or mounting the Docker socket, can facilitate container escapes or unauthorized host-level access.
This rule detects potential exploitation of the CVE-2026-48558 vulnerability in SimpleHelp servers by monitoring for specific sequences of log markers related to authentication bypass and unauthorized configuration changes. It flags anomalous technician registrations, OIDC attribute fetching, and 'New Anon' configuration saves within a 60-second window, which are indicative of an attacker attempting to gain unauthorized access or manipulate session security.
Detects potential container escape attempts via 'docker cp' path traversal attacks or suspicious shell execution spawned from the Docker daemon. The rule monitors for directory traversal sequences in 'docker cp' commands, the use of PoC tooling strings, file modifications outside expected container paths, and shell process spawning originating from Docker-related parent processes.
Page 175 of 347