Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the execution of tools associated with HTTP/2 upgrade queue poisoning proof-of-concept (PoC) code or anomalous process-level interactions involving nghttpx. It tracks specific command-line strings, file operations, and unauthorized spawned sub-processes originating from nghttpx, which could indicate attempts to exploit request smuggling vulnerabilities in HTTP/2 implementations.
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
Detects instances where scripting engines (Python or Node.js) access known SSH private key files and subsequently initiate a successful network connection to a non-private IP address within a 60-second window. This behavior is indicative of potential credential exfiltration or unauthorized remote access.
Detects the execution of QEMU processes configured with specific network redirection flags (hostfwd) targeting standard SSH ports, or utilizing suspicious file paths (e.g., .db, .dll) as virtual disk backing files. This behavior is indicative of adversaries utilizing QEMU to establish covert reverse SSH tunnels or staging malicious artifacts within virtualized environments.
Detects potential remote code execution (RCE) attempts targeting Langflow that manifest as the spawning of child shell processes or the execution of curl/wget commands to download and execute malicious scripts (specifically 'isp.sh') from the IP address 83.142.209.214. It also monitors for Python-based execution patterns using 'os.system' to drop or execute these payloads.
Detects anomalous child process creation from typical web and application server processes (IIS w3wp.exe or Openfire Java processes). This behavior is consistent with post-exploitation activity following web application vulnerability exploitation, specifically web shell deployment and execution of reconnaissance or secondary payload staging commands.
Detects anomalous external scanning activity against internal web applications by monitoring for multiple requests to sensitive URI paths associated with vulnerability exploitation (e.g., cgi-bin, admin-ajax.php, .env, or command execution endpoints) originating from external IP addresses to internal network space.
Detects the execution of known Command and Control (C2) frameworks such as Sliver, Havoc, SparkRAT, or VShell from common suspicious temporary or staging directories (temp, tmp, appdata, programdata). This rule monitors process creation events to identify the presence of these unauthorized remote access tools.
Detects the use of BPF syscalls by non-root processes or the execution of BPF-related utilities (bpftool, bpfcc) from an interactive shell. This behavior is often associated with the ShadowGuard rootkit and potential BPF-based backdoor activity, which leverages BPF programs for stealthy system monitoring or command execution.
Detects execution of unusual preinstall, setup, or GitHub scripts initiated by Node Package Manager (npm) or node processes. This behavior is indicative of a supply chain attack or malicious dependency execution during the installation process of a package.
Detects anomalous behaviors associated with malicious npm package self-upgrades, where node.exe modifies its own source files within node_modules or spawns npm pack commands to replace existing dependencies with malicious versions.
Detects Node.js, NPM, or NPX processes attempting to read sensitive shell history files (e.g., .bash_history, .zsh_history). This behavior is characteristic of malicious activity such as infostealers attempting to harvest credentials or reconnaissance data from a compromised developer environment, notably observed in supply chain campaigns like the Polymarket Trap.
Detects reconnaissance and exploit activity associated with the BUMSRAKETE exploit (CVE-2026-45257) targeting FreeBSD. The rule identifies system configuration checks of kernel parameters related to kTLS and mbuf external pages, as well as the execution of file permission manipulation commands often required to bypass immutable (schg) file flags during the exploitation process.
Detects indicators of the BUMSRAKETE FreeBSD kernel-level exploit (CVE-2026-45257). This rule monitors for exploit artifact file creation, malicious use of dd to overwrite SUID binaries for privilege escalation, kernel configuration enumeration via sysctl, spawning of shell processes with root UID from suid-related binaries, and kernel version fingerprinting.
Detects evidence of exploitation for CVE-2026-45257, a FreeBSD vulnerability that allows bypassing chflags schg immutable flags. The detection tracks the initial reconnaissance phase where unprivileged processes query the sysctl 'kern.ipc.mb_use_ext_pgs' followed by the creation of specific exploit restorer artifacts '/tmp/.lpe_orig' and '/tmp/.x'.
Detects instances where npm or node processes execute suspicious shell commands or scripts, often associated with software supply chain attacks. The rule looks for child processes like shell interpreters (sh, bash) or utilities (curl, wget, python) initiated by node/npm, combined with suspicious command-line patterns indicative of obfuscated execution or malicious package lifecycle scripts.
Detects instances of the systemd-userdbd process executing from non-standard file paths or general systemd-related processes launching from world-writable or temporary directories (e.g., /tmp, /dev/shm, /var/tmp, /home). This behavior is often indicative of process masquerading or a persistence mechanism where an adversary attempts to execute a malicious binary by mimicking system service naming conventions.
Detects the execution, installation, or configuration of Tailscale, a legitimate remote access tool. The rule monitors for common command-line arguments like '--authkey' and 'up', service-related activity, and execution from non-standard file paths. It flags instances where Tailscale is spawned by common script interpreters or command shells, which is a common indicator of unauthorized remote access or C2 implant activity.
Detects the creation of a potentially malicious shared library (libcache.so) in /usr/local/lib followed by a modification of the /etc/ld.so.preload file on Linux systems within a short time frame. This technique is commonly used for persistence and code injection, where the dynamic linker is forced to load the malicious library before others.
Detects indicators of persistence via dynamic linker hijacking on Linux systems, specifically looking for the creation or usage of .libcache.so, modifications to /etc/ld.so.preload, hidden shell profile droppers, or node process execution utilizing LD_PRELOAD variables.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Page 176 of 347