Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Gitea act_runner processes spawning Docker containers with dangerous configurations, such as privileged mode, host namespace mounts, or security-opt bypasses, followed by the execution of 'nsenter' or shell processes, which are indicative of a container escape attempt to the host.
Detects reconnaissance and exploitation setup activities associated with CVE-2026-46331 (pedit COW). The rule identifies processes enumerating kernel versions via system files or commands, checking unprivileged user namespace capabilities, and configuring network traffic control (tc) filters with pedit actions, which are critical precursors to leveraging the pedit page cache corruption vulnerability.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
Detects suspicious system calls by unprivileged users involving unshare, IPsec XFRM policy configuration, and kernel module loading. This specific sequence is used in the DirtyClone (CVE-2026-43503) exploit, which leverages local IPsec tunnels to perform page-cache corruption and modify sensitive system binaries in memory.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
Detects suspicious command execution on Linux-based SOHO/IoT devices, specifically targeting patterns associated with log deletion, unauthorized cron job modification, busybox utility abuse, and temporary directory execution. This activity is often linked to botnet recruitment and reconnaissance behaviors such as those observed in the JDY and Volt Typhoon campaigns.
Detects a suspicious sequence of events where a file with an architecture-specific name (often associated with botnet payloads like JDY/KV-botnet) is created, executed, and deleted within a 60-second window. This behavior is indicative of transient malicious payloads executing and self-removing to evade detection.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Detects high-volume outbound network scanning activity from a single internal source device. The rule identifies anomalous behavior characterized by rapid connection attempts to a large number of distinct destination IPs and ports, consistent with scanning patterns observed in botnets like JDY, which often target edge network infrastructure (Cisco, Ubiquiti, Draytek).
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects CI/CD package manager traffic (e.g., pip, npm) attempting to connect to domains that mimic legitimate PyPI or npm registry domains. This behavior is indicative of a dependency confusion or supply chain attack where an adversary uses typosquatted or phantom-squatted domains to intercept or redirect package requests.
Detects potential dynamic linker hijacking on Linux systems by monitoring for the use of non-standard LD_PRELOAD paths in process command lines or unauthorized modifications to the /etc/ld.so.preload configuration file, which can be used to inject malicious code into processes.
This rule detects HTTP requests attempting to perform Local File Inclusion (LFI) or path traversal attacks by searching for patterns such as '/../' sequences and common sensitive file paths like /etc/passwd, /etc/shadow, or /proc/self/environ in the URI.
Detects suspicious execution patterns originating from Gitea act_runner that indicate potential container escape attempts or host namespace manipulation. The rule flags the use of sensitive docker flags such as --pid=host, --ipc=host, --cap-add=ALL, and security profile unconfining, alongside the execution of 'nsenter' or the existence of specific proof-of-concept markers related to container escape vulnerabilities.
This rule monitors for file and process events associated with known malicious Chrome extensions. It filters for specific extension IDs embedded within file paths or command-line strings, which typically indicate the installation or activity of malicious browser plugins.
Detects node.exe processes or file operations involving suspicious strings like 'piterpan', 'pmtrader', or 'DEFAULT_USERNAME_TAG', which are associated with malicious activity or unauthorized staging of scripts within the node environment.
Detects instances where a Node.js or NPM process spawns the systemd-userdbd utility. This behavior is highly irregular in standard Linux environments and may indicate an attempt to interact with system user databases, potentially for privilege escalation, persistence, or credential discovery by an application running in the Node.js runtime.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
Detects suspicious child processes (such as shell interpreters or downloader tools) spawned by Langflow, uvicorn, or python processes. The rule focuses on common indicators of post-exploitation activity, including code execution via python arguments, use of curl/wget to pull payloads, and execution of shell scripts often associated with malware droppers.
Page 177 of 347