Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
Detects host-level configuration changes indicative of preparing a system for the CVE-2026-46331 pedit COW exploit. This includes enabling unprivileged user namespaces via sysctl and disabling security mitigations or removing the act_pedit kernel module.
Detects anomalous process spawning behavior initiated by AI IDE extensions (e.g., Amazon Q, Claude Code, Cursor) when loading Model Context Protocol (MCP) configuration files. The rule flags instances where these IDE components trigger suspicious child processes or command-line executions, which could be indicative of remote code execution (RCE) via malicious mcp.json workspace configurations.
Detects malicious attempts to impair system defenses on Linux hosts, specifically targeting AppArmor, SELinux, firewalls (UFW/iptables), and security monitoring agents (Crowdstrike/osquery/Aliyun) by the 'lambsys' cryptominer campaign. This behavior aligns with adversary attempts to evade detection and maintain persistence or resource consumption.
This rule detects potentially unauthorized installation of extensions in Visual Studio Code (VSIX) or plugins in JetBrains IDEs (IntelliJ, PyCharm, WebStorm). It flags installations that do not originate from verified official marketplaces, which may indicate the manual installation of malicious or supply-chain compromised development environment extensions.
Detects evidence of active exploitation targeting the libarchive ZIP entry declared-vs-actual size boundary vulnerability. The rule identifies the execution of known proof-of-concept (PoC) scripts (make_debuginfod_zip.py, run_stock_marker.py) as well as the creation of specific marker files or CLI output from bsdunzip/bsdtar that confirm successful boundary exploitation.
Detects the presence of specific file artifacts ('VULNERABILITY_CONFIRMED.marker', 'smtp-crlf-injection.curlrc') associated with the 'curl-smtp-expn-recipient-crlf-injection' proof-of-concept repository. The rule also correlates this with the execution of the associated 'run_demo.py' script from directories containing 'curl-smtp', helping identify active use of this testing framework.
Detects the presence of known malicious Chrome extension IDs, suspicious configuration files (e.g., perplexity-rules.json, bing-rules.json), or extensions utilizing invasive declarativeNetRequest permissions, which are often used for browser-based exfiltration or credential interception.
Detects suspicious subprocesses spawned by IDE or extension host processes (like VS Code or Amazon Q) that execute AWS CLI commands to enumerate identity or immediately exfiltrate data via curl/wget, indicating potential credential abuse by malicious plugins or MCP servers.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
Detects activity indicative of container escape attempts, specifically identifying the use of 'docker cp' with path traversal sequences to manipulate host files, or the unauthorized execution of shells and utilities directly spawned by the container runtime daemon (dockerd). It also monitors for execution patterns associated with known container escape proof-of-concept scripts.
Detects potential container breakout or privilege escalation attempts originating from Gitea act-runner processes. The rule monitors for the execution of containers with dangerous security configurations (e.g., host PID/IPC namespace, privileged capabilities, disabled security modules) or the use of nsenter to break out of a container into the host environment.
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Detects a Node.js process, spawned as a child of an IDE (e.g., VS Code, Cursor), that accesses local AWS configuration or credential files followed by an outbound network connection to a non-AWS destination. This behavior is indicative of potential cloud credential exfiltration via malicious Model Context Protocol (MCP) server execution.
Detects the creation of Model Context Protocol (MCP) server configuration files (such as .mcp.json or those in .vscode/ and .amazonq/ directories) shortly after a Git operation (pull, fetch, merge, or clone). This pattern is indicative of a supply chain attack where a contributor introduces malicious MCP configurations into a workspace, which are subsequently loaded by development tools like VS Code, Cursor, or language servers to execute arbitrary code or exfiltrate data.
Detects the use of the 'docker cp' command with suspicious path traversal characters or known PoC artifacts in the destination parameter. This behavior is indicative of an attempt to exploit path traversal vulnerabilities in the Docker daemon (such as those allowing container escape) by writing files outside the container's intended scope onto the host filesystem.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
Detects processes accessing sensitive files on a Linux system, such as SSH private keys, shell history files, and various application-specific configuration or credential files (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). The rule excludes common system processes like shells, SSH daemons, git, and curl to minimize noise while identifying suspicious file access.
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects unauthorized file access to common developer credential storage locations on Linux workstations, including SSH keys, cloud provider configuration files, and browser session artifacts. This behavior is associated with the InvisibleFerret payload used in the Lazarus Contagious Interview campaign to exfiltrate identity and access tokens from developer machines.
This rule detects processes associated with scripting languages like Python and Node.js that are attempting to access clipboard data or use clipboard-related libraries (e.g., pyperclip, win32clipboard, xclip). This behavior is common in info-stealer malware, such as InvisibleFerret, which uses the clipboard to harvest sensitive user data.
Page 186 of 347