Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects host fingerprinting and geolocation activity performed by the Lambsys/procq cryptominer. The rule identifies processes like curl or wget querying external IP intelligence services (ipinfo.io, ip-api.com) when associated with suspicious binary paths or spawned by known miner processes.
Detects recurring network connections (beaconing) to domains ending in 'azurewebsites.net' over HTTPS (port 443). The rule identifies potential command and control (C2) behavior by aggregating counts of connections and distinct destination IPs per process and host over time, flagging activity that exhibits regular, repeating patterns.
Detects rapid or aggregate access to multiple sensitive credential or configuration files across various applications (e.g., AWS, Docker, Kubernetes, Crypto wallets, AI tools) within a short timeframe. This behavior is indicative of credential harvesting or post-compromise reconnaissance to steal secrets and keys.
Detects command-line activity searching for, accessing, or displaying sensitive credential and configuration files on Linux systems, such as AWS credentials, Kubernetes configurations, Docker settings, or application API keys. This behavior is indicative of credential theft or discovery attempts.
Clipboard hijacking malware for cryptocurrency address substitution
Detects the creation of files with extensions commonly associated with web shells (.php, .aspx, .jsp) within typical web application directories by common web server processes such as httpd, nginx, php-cgi, and w3wp. This activity is indicative of a potential web shell deployment for persistent access or command execution.
Detects unauthorized execution of native binaries initiated by npm during the package installation process. This rule targets the IronWorm supply-chain campaign, where compromised npm packages utilize preinstall hooks or node-gyp build processes to execute malicious binaries (often Rust-based) from unconventional paths within the package directory.
Detects the use of the 'git commit --date' flag to manually set commit timestamps, a technique utilized by the IronWorm campaign to backdate malicious commits and manipulate repository history to appear benign or legacy-originating.
Detects the loading of an eBPF rootkit by Node.js or NPM processes. This rule monitors for file creation events within the /sys/fs/bpf/ directory triggered by these processes, which is a known behavior of the IronWorm infostealer attempting to hide processes and network connections.
Detects suspicious git commit activity associated with the IronWorm campaign. The rule monitors for git operations involving backdated commits or force-pushes, particularly those using a specific noreply email address or common maintenance commit messages, which are indicative of supply-chain compromise and timestomping techniques within npm repositories.
Detects instances where a Node.js process (invoked via npm) spawns suspicious secondary processes such as shell interpreters (cmd, powershell, sh, bash) or network utilities (curl, wget). This pattern is often indicative of malicious npm lifecycle scripts (e.g., preinstall, postinstall) attempting to perform system reconnaissance or download secondary payloads.
Detects instances where a Node.js process accesses, creates, or modifies sensitive files such as SSH private keys, AWS credentials, or application configuration files (.npmrc, .pypirc, .docker/config.json). This behavior is often indicative of credential theft or unauthorized configuration access by a compromised Node.js application.
This rule detects various stages of exploitation associated with the CVE-2026-45257 'BUMSRAKETE' vulnerability, which targets FreeBSD kernels. It monitors for the execution of exploit binaries, compilation of source code related to the exploit, the presence of specific staging files in temporary directories, and the subsequent spawning of shells by the exploit process. It also identifies command-line arguments indicative of BUMSRAKETE activity.
Detects post-exploitation activities related to the CVE-2026-45257 BUMSRAKETE vulnerability on FreeBSD. The rule monitors for kernel module loading using kldload from suspicious directories, kldstat execution, unauthorized root-level crontab modifications, and suspicious root-level shell execution spawned from non-standard parent processes, all of which indicate potential persistence or rootkit installation following a local privilege escalation.
Detects Node.js processes spawning from common command-line shells (npm, cmd, bash) and accessing sensitive credential directories, such as '.claude' or Docker 'config.json'. This behavior is indicative of credential theft or unauthorized access attempts often associated with malicious npm packages or supply chain attacks.
Detects exploitation attempts against Langflow targeting unauthenticated API endpoints (/api/v1/build_public_tmp or /run) for remote code execution, as well as downstream process spawning activity on Linux hosts where Python processes execute shell commands (e.g., curl/wget piping to sh) to download known malicious dropper payloads.
Detects execution of the BUMSRAKETE exploit targeting the CVE-2026-45257 FreeBSD kTLS-RX page-cache corruption vulnerability. The rule identifies the exploit binary launching from a non-privileged context alongside the creation of staging files used to corrupt system binaries and escalate privileges to root.
Detects unauthorized access to sensitive credential files (Docker, AWS, npm, PyPI, GCloud) by Node.js processes, specifically when those processes are triggered by common npm lifecycle scripts like preinstall, postinstall, or peer dependency scripts. This is a common pattern observed in supply chain attacks involving malicious npm packages.
Detects the execution of Python scripts that include libraries (pynput, pyxhook) or functions (GetAsyncKeyState, WH_KEYBOARD_LL) frequently used by keyloggers to capture user keystrokes. It also monitors for suspicious input device access and command-line arguments indicative of keystroke monitoring.
Detects non-privileged execution of system commands (sysctl, freebsd-version, uname) used to query kernel parameters and system configuration. These actions serve as reconnaissance prerequisites for exploiting the BUMSRAKETE (CVE-2026-45257) local privilege escalation vulnerability on FreeBSD systems.
Detects execution and post-exploitation behaviors associated with the BUMSRAKETE exploit, specifically targeting page-cache overwrite privilege escalation (CVE-2026-45257). The rule identifies the presence of malicious binaries, staging artifacts in /tmp, and unprivileged processes spawning shells via SUID binaries (su, passwd) that indicate successful exploitation.
Page 181 of 347