Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects attempts to exploit CVE-2024-36401, a critical remote code execution vulnerability in GeoServer. The rule monitors inbound HTTP requests to GeoServer OWS or WFS endpoints for malicious patterns consistent with OGC filter expression injection, such as attempts to invoke Java Runtime process execution via crafted property names or OGC expressions.
Detects the execution of 'unshare' with flags (such as --user/--net or CLONE_NEWUSER/CLONE_NEWNET) by unprivileged users. This behavior is indicative of attempts to gain CAP_NET_ADMIN capabilities within a new namespace, a necessary precursor to exploiting the pedit COW (CVE-2026-46331) vulnerability for privilege escalation.
Detects PHP processes reading both /proc/self/maps and /proc/self/mem within a short time window. This activity is indicative of an Address Space Layout Randomization (ASLR) bypass technique, specifically associated with exploits attempting to compute memory offsets for sensitive functions (e.g., zend_execute_internal, zif_system) to facilitate Remote Code Execution (RCE).
This rule detects the creation of Amazon Q Model Context Protocol (MCP) configuration files, identified by 'mcp.json' in specific directories. It additionally correlates this file creation event with concurrent Git operations (checkout, merge, pull, or fetch) performed by a user, flagging the activity as a higher risk signal if both conditions are met.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
This rule detects activities related to the 'ipv6_extlen_wrap_probe' proof-of-concept (PoC) exploit, which targets IPv6 extension header vulnerabilities. The detection logic monitors for: 1. Execution of the PoC binary, 2. Compilation of the PoC source code using common compilers like g++ or MinGW, 3. Creation of files associated with the PoC, and 4. Nmap execution with specific flags indicative of an attempt to trigger the vulnerability via raw IPv6 scanning.
This rule detects activities related to the 'Exploitarium' DLX exploit proof-of-concept (PoC) toolkit. It monitors for the invocation of 'objdump' with specific flags used in these exploits, the presence of associated Python and shell scripts on the filesystem, and the spawning of suspicious child processes (like command interpreters or calculators) by 'objdump', which acts as an indicator of successful exploitation or exploit testing.
Detects Server-Side Template Injection (SSTI) attempts targeting the Floci API Gateway, specifically looking for Velocity Template Language (VTL) payloads intended to trigger Remote Code Execution via 'java.lang.ProcessBuilder', along with indicators of an IAM credential scope bypass.
Detects network requests to a typosquatted domain 'perplexity-ai.online' initiated by a malicious browser extension. The extension uses the 'suggest_url' feature to exfiltrate keystrokes typed into the browser omnibox in real-time, effectively performing browser-based keylogging.
Detects suspicious activities originating from SimpleHelp remote support processes, including the spawning of unauthorized child processes, execution of potentially malicious JavaScript loaders (e.g., TaskWeaver-related), and access to sensitive browser-based credential or configuration files often targeted by infostealers like Djinn Stealer.
Detects potential Velocity Template Language (VTL) injection attacks targeting API Gateway environments. The rule identifies suspicious payloads in HTTP request bodies or URLs that attempt to leverage Java-based classes (e.g., ProcessBuilder) for code execution. It also monitors for IAM scope bypass attempts, abnormal HTTP method/path combinations associated with API Gateway control-plane operations, and evidence of shell/system commands being spawned from API Gateway-related parent processes.
Detects anomalous or unauthorized processes accessing sensitive AI configuration files, SSH configurations, version control files, and shell history within a short time window. The rule flags instances where non-standard or unexpected applications exhibit broad or high-frequency access to these files, which are common targets for credential harvesting or exfiltration by adversaries.
This rule identifies suspicious outbound network beaconing by analyzing flow statistics for consistency in interval and payload size. It flags processes that demonstrate periodic communication (heartbeats) to external endpoints on non-standard ports. The detection logic calculates a 'beacon_score' based on the consistency of the communication interval, small average payload sizes, low variance in payload sizes, and the number of connections. Additional weighting is applied to connections made by typically non-network processes (e.g., svchost, explorer, wscript) or those connecting to ports associated with known malware like SystemBC.
Detects web server processes (e.g., PHP, IIS, Apache, Nginx) spawning suspicious child processes including shells (cmd.exe, powershell, bash) or network utilities (curl, wget, netcat), which is often indicative of webshell exploitation or post-compromise activity.
Detects instances where AI coding assistants (e.g., Claude Code, Cursor, Windsurf) spawn shell interpreters or scripting runtimes that subsequently initiate outbound network connections to non-private IP addresses. This behavior is indicative of potential malicious activity, such as credential theft or workspace trust bypass exploits (e.g., CVE-2026-12957), where an attacker leverages an AI coding assistant to execute arbitrary code. The rule excludes common build and test runner processes to minimize false positives.
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
This rule detects the execution of specific malicious npm packages (jsonwebauth, fake-font) and associated script files (lserver.js, errorHandler.js) linked to Lazarus Group activity. It monitors node.exe processes for suspicious command lines, child processes originating from associated directories, and npm installation activities involving these packages.
Detects instances where common scripting runtimes (Python, Node.js) or development-related parent processes (e.g., VS Code, npm) access sensitive cloud credential or configuration files (AWS, Google Cloud, Azure). This behavior may indicate an adversary or an unauthorized script attempting to exfiltrate or leverage stored cloud credentials from an developer workstation.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects suspicious network activity from common scripting and runtime environments (Python, Node.js) that communicate with known blockchain-related infrastructure (e.g., Tron, Aptos). The rule flags processes that establish connections to multiple distinct external IP addresses while querying these specific domains, which may indicate cryptocurrency mining, wallet-stealing malware, or unauthorized distributed computing activity.
Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.
Page 179 of 347