Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
Detects the use of npm to install known malicious npm packages, which is indicative of a supply chain compromise attempt via typosquatting or malicious dependency injection.
Detects malicious browser extensions associated with the StegoAd campaign fetching steganographic payloads (WebP/PNG) from known C2 infrastructure. The detection identifies requests originating from a browser extension context (via Referer header) that target specific image files commonly used by the malware for post-compromise staging and execution guardrail fingerprinting.
Detects the upload and execution of a specific malicious CSV file (evil_tenant.csv) on Cisco SD-WAN Manager (vManage) systems. This file is associated with exploitation of CVE-2026-20245, enabling attackers to inject a persistent root backdoor account into the system files.
Detects the execution of common system enumeration commands (process listing, network configuration, and system information) on Cisco SD-WAN infrastructure nodes. This activity is indicative of post-exploitation reconnaissance used by attackers to understand the system environment, network topology, and identify potential pivot points within the SD-WAN infrastructure.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects various techniques used by an attacker to escape a container environment or gain unauthorized access to host-level resources. This includes the execution of namespace manipulation tools (nsenter, unshare, chroot), unauthorized access to the docker.sock Unix socket, mounting of host filesystems from within a container, and direct attempts to access the host's /proc/1 namespace files.
Detects the execution and network activity of known reverse tunneling and proxy tools such as Chisel, Ngrok, and FRP. These tools are commonly abused by adversaries to establish persistence, bypass firewalls, and facilitate command and control (C2) communication. The rule monitors for specific process names, command-line arguments, and DNS requests related to these services.
Detects processes attempting to connect to the Cloud Instance Metadata Service (IMDS) IP address (169.254.169.254) or referencing it in the command line. This behavior is often associated with credential theft or reconnaissance on cloud instances.
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
This rule detects HTTP requests attempting to perform Local File Inclusion (LFI) or path traversal attacks by searching for patterns such as '/../' sequences and common sensitive file paths like /etc/passwd, /etc/shadow, or /proc/self/environ in the URI.
Detects attempts to exploit the Shellshock vulnerability (CVE-2014-6271) by inspecting HTTP request headers for the characteristic function definition syntax '() { :;'. This pattern is commonly used in malicious payloads to trigger command execution via environment variables in CGI scripts.
Detects multiple TCP connection attempts to port 22 (SSH) from the same source within a 60-second window, which is indicative of a brute-force or password guessing attack against SSH services.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
This rule detects HTTP POST requests to a MyBB forum administrative panel targeting the 'user-users' module, specifically attempting to assign a user to the 'Administrator' group (group ID 4). This pattern is indicative of an exploitation attempt or unauthorized administrative account manipulation.
This rule detects potential exploitation of the Ghidra vulnerability CVE-2026-45115, which allows arbitrary code execution during the loading of malicious project files or scripts. It monitors for suspicious child processes (e.g., cmd.exe, powershell.exe, bash) spawned by core Ghidra executables (ghidraRun, analyzeHeadless), which is characteristic of successful exploitation.
Detects AI-powered development tools like Claude Code (running via node) spawning shell interpreters, executing common setup/configuration scripts, or invoking network utilities during project initialization. This activity is indicative of indirect prompt injection attacks where an adversary lures an AI agent into executing malicious code from a repository.
Page 176 of 341