Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects instances where a user within the MyBB Admin Control Panel (ACP) attempts to create a new user account and assign it to the administrator usergroup (gid=4). This activity is indicative of a privilege escalation attempt by an authenticated user with limited administrative access or an attacker who has compromised such an account.
Detects DNS queries originating from endpoints to common URL shortening services such as bit.ly, goo.gl, and others. These services are frequently abused by adversaries for C2 communications, distributing malware, or phishing, as they can mask malicious destination URLs.
Detects attempts to escape a Docker container to the host filesystem by exploiting directory traversal vulnerabilities within the 'docker cp' command. It identifies suspicious CLI arguments indicating path traversal, the presence of known PoC artifacts, and file write events initiated by the Docker daemon outside of expected container directory paths.
Detects exploitation attempts against Gitea instances where an attacker impersonates an admin user by injecting the 'X-WEBAUTH-USER' header. This vulnerability typically occurs when 'REVERSE_PROXY_TRUSTED_PROXIES' is misconfigured to trust all proxies ('*'), allowing unauthenticated users to gain administrative access via header manipulation. The rule covers web request headers, container logs for suspicious admin creation, and process execution arguments associated with the exploitation.
Detects the presence of malicious artifacts associated with the RoguePlanet campaign by ShinyHunters and Chaotic Eclipse, including specific malware families (BlueHammer, RedSun, UnDefend, Bluekit) and libpwn exploit harness components related to CVE-2026-55200.
This rule detects the execution of container runners (act-runner/gitea-act-runner) with insecure container isolation flags, such as mounting the host root filesystem, disabling security profiles (seccomp/apparmor), or running with host namespaces and excessive capabilities. These configurations indicate potential container escape attempts or misconfigurations that allow significant host-level access.
Detects rapid enumeration of system binaries related to SSH and networking libraries (libssh2, libcurl, libgit) or version checks within a 5-minute window, which may indicate reconnaissance or pre-exploitation activity related to vulnerabilities like CVE-2026-55200.
Detects the exploitation of CVE-2026-20896 in Gitea, where an unauthenticated attacker sends a crafted POST request to user registration or installation endpoints. The rule triggers when this network activity is followed by the creation of a new user account with administrative roles within a 10-minute window, indicating potential privilege escalation.
Detects instances where processes associated with Claude AI (e.g., node, shell) spawn suspicious child processes such as Python interpreters, pip package managers, or shell scripts (sh, bash) with command-line arguments indicative of AI-driven project initiation, package installation, or automated setup tasks. This pattern is characteristic of AI-based agents executing code or performing automation on a developer workstation.
Detects suspicious command execution patterns, including reverse shell techniques (/dev/tcp, bash -i), DNS-based C2 communication (axiom-config, m100.cloud), and fileless payload retrieval (dig TXT queries). It specifically highlights commands initiated by common AI developer tools or runtimes (claude, node, python) that correlate with known adversarial setup scripts or potential prompt injection outcomes.
Detects the execution of the 'unshare' utility on Linux systems using command-line arguments that indicate the creation of new namespaces, particularly targeting user and network namespace isolation. Adversaries often use 'unshare' to bypass security controls or to facilitate container escapes by isolating processes from the host's environment.
This rule detects the use of specific Linux utilities often associated with local privilege escalation or container escape techniques. It monitors for commands involving 'unshare' with flags that allow user or network namespace manipulation, network traffic control ('tc') commands specifically interacting with 'pedit' or 'qdisc' which can be abused for kernel-level manipulation, 'ip netns' commands to manage network namespaces, and execution of known exploit-related filenames like 'pedit_cow_demo' or 'packet_edit_meme'.
Detects non-root users utilizing the 'tc' or 'ip' utilities to interact with kernel traffic control structures (qdisc/filter/action) specifically involving 'pedit' actions. This activity is a documented prerequisite for exploiting CVE-2026-46331, a vulnerability enabling page cache poisoning and local privilege escalation.
Detects the resolution of DNS TXT records using dig, followed by piping the decoded base64 output directly to bash for execution. This technique is characteristic of fileless payload delivery and remote command execution, specifically observed in the Axiom indirect prompt injection attack chain.
Detects the creation of user namespaces combined with network namespace flags using 'unshare' or 'ip netns' by non-root users. This activity is a necessary precursor for exploiting the CVE-2026-46331 vulnerability (pedit COW) to gain CAP_NET_ADMIN capabilities and subsequently corrupt the Linux page cache.
Detects unauthorized writes to the /proc/sys/vm/drop_caches interface by non-root users or processes that are not standard system maintenance tools. This activity is a known post-exploitation technique used by exploits like the 'pedit' COW exploit to clear cached setuid binary pages in memory for evasion or cleanup.
Detects suspicious execution of kernel-related networking commands ('unshare', 'ip', 'modprobe', 'insmod') by non-root users that are associated with the setup or exploitation phases of the 'DirtyClone' Linux kernel privilege escalation exploit. The rule specifically looks for IPsec tunnel/policy manipulation or the loading of ESP/RxRPC kernel modules by unprivileged accounts.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Infostealer distributed via fake open-source tool impersonation sites
LockBit C2Beacon
YARA
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Lightweight remote access trojan deployed in recruiter-themed social engineering
Page 181 of 341