Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects processes accessing sensitive files on a Linux system, such as SSH private keys, shell history files, and various application-specific configuration or credential files (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). The rule excludes common system processes like shells, SSH daemons, git, and curl to minimize noise while identifying suspicious file access.
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects unauthorized file access to common developer credential storage locations on Linux workstations, including SSH keys, cloud provider configuration files, and browser session artifacts. This behavior is associated with the InvisibleFerret payload used in the Lazarus Contagious Interview campaign to exfiltrate identity and access tokens from developer machines.
This rule detects processes associated with scripting languages like Python and Node.js that are attempting to access clipboard data or use clipboard-related libraries (e.g., pyperclip, win32clipboard, xclip). This behavior is common in info-stealer malware, such as InvisibleFerret, which uses the clipboard to harvest sensitive user data.
This rule detects potentially malicious activity where 'npm' or 'node' processes spawn sensitive child processes (e.g., cmd.exe, powershell.exe, python.exe, curl.exe) in contexts associated with package installation (e.g., node_modules, postinstall scripts) or known indicators of compromise related to supply chain attacks and credential theft.
Detects suspicious network activity from common scripting and runtime environments (Python, Node.js) that communicate with known blockchain-related infrastructure (e.g., Tron, Aptos). The rule flags processes that establish connections to multiple distinct external IP addresses while querying these specific domains, which may indicate cryptocurrency mining, wallet-stealing malware, or unauthorized distributed computing activity.
Hunting rule for tar archive creation of user home trees, common staging before scp/rsync exfiltration over SSH. Prioritize /tmp archives and remote copy in the same session.
Detects the installation of known malicious Chrome extensions, specifically Adblock for YouTube, Adblock for Chrome, Adblock for You, and AdBlock Suite. These extensions have been associated with malware distribution, removal from the Chrome Web Store, or dormant remote code execution capabilities via server-fetched scriptlets.
Detects exfiltration of data to Dropbox cloud storage
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
Detects the use of 'sshpass' with disabled host key checking ('StrictHostKeyChecking=no') to automate SSH connections. The rule specifically targets command lines referencing administrative accounts ('psoft', 'oracle', 'linuxadm'), a technique associated with ShinyHunters lateral movement activity.
Detects a highly relevant Antivirus alert that reports a web shell.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the execution of MeshCentral agent commands, specifically the 'RunCommand' feature, which is often used by adversaries for post-compromise remote command execution and payload staging. This rule monitors both endpoint process activity and system logs for command-line arguments involving meshctrl.js and RunCommand.
Detects high-volume failed authentication attempts targeting a specific user account from a source IP address, indicative of 'MFA fatigue' or 'push bombing' attacks. This rule monitors endpoint-visible logon failure events as captured by EDR telemetry to identify potential attempts to circumvent multi-factor authentication by spamming the user with requests.
Hunting rule loosely modeled after Atomic Red Team T1048.002 test "Exfiltrate data in a file over HTTPS using wget". No public in-the-wild intel reference available; correlate before alerting.
Detects anomalous outbound network connections initiated by media server processes (Jellyfin, FFmpeg, or Nextcloud) immediately following an inbound video file upload (AVI) to the media server's API, indicative of post-exploitation activity related to the PixelSmash (CVE-2026-8461) heap out-of-bounds write vulnerability.
Detects the use of 'curl' with '-X PUT' and '--data-binary' options, which can indicate data exfiltration or staging activities. This combination is often used to upload raw data to a specified endpoint.
Detects a sequence of events characteristic of a privilege escalation exploit (referenced as CVE-2026-46331). The chain involves an unprivileged user creating a user namespace, followed by the configuration of traffic-control (tc) filters, and finally accessing sensitive setuid binaries or memory files (/proc/self/mem), indicating an attempt to escalate privileges to root.
Detects a potential privilege escalation attempt targeting the DirtyClone (CVE-2026-43503) vulnerability, where an unprivileged process executes /usr/bin/su with specific command line arguments to spawn a shell without proper authentication, effectively gaining root access.
Detects the exploitation chain of the DirtyClone (CVE-2026-43503) vulnerability on Linux systems. The rule monitors for a sequence involving an unprivileged user (UID > 1000) creating a new user/network namespace, configuring an IPsec XFRM state with loopback source/destination addresses, modifying sensitive memory via /proc/self/mem or /proc/<pid>/mem to bypass Copy-on-Write (CoW) protections, and ultimately spawning a process with root privileges.
Page 179 of 341