Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts'. The rule identifies suspicious SSH activity by looking for 'sshpass' execution or multiple 'ssh' commands with specific PeopleSoft-related usernames, potentially preceded by commands to read '/etc/hosts'.
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
Detects unauthorized access to sensitive cryptographic files, such as SSH private keys, GPG secret keys, or Windows certificate store files, by unauthorized or anomalous processes (specifically node/npm or processes within /tmp). This is followed by potential outbound exfiltration via an external network connection or the mass access of multiple sensitive files within a short timeframe.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
Detects the use of 'sshpass' to automate SSH authentication, often used for lateral movement. The rule monitors command lines for the 'sshpass' utility combined with 'StrictHostKeyChecking=no' and specific service accounts (psoft, oracle, linuxadm) often targeted by threat actors such as ShinyHunters.
This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.
Correlates a successful authentication from a new, untrusted IP address utilizing a Linux/Kali User-Agent, a known signature of the Kali365 framework.
Detects suspicious process activity originating from common build and package management tools (node, npm, bun, npx) that targets sensitive cloud and container credential locations, such as AWS IMDS, AWS configuration files, Kubernetes service account tokens, and HashiCorp Vault secrets. This rule is designed to identify malicious post-installation scripts or build processes attempting to exfiltrate credentials from developer or CI/CD environments.
Hunting rule for tar archive creation of user home trees, common staging before scp/rsync exfiltration over SSH. Prioritize /tmp archives and remote copy in the same session.
Hunting rule for tar archive creation of user home trees, common staging before scp/rsync exfiltration over SSH. Prioritize /tmp archives and remote copy in the same session.
Detects the execution of 'aws sts get-caller-identity' spawned by IDE-related processes such as VS Code extension hosts or Amazon Q language servers. This pattern may indicate cloud credential reconnaissance performed by a malicious MCP (Model Context Protocol) server or compromised development extension (CVE-2026-12957).
Detects the execution of a /bin/sh root shell initiated by /bin/su where the parent process indicates a non-root context. This pattern is characteristic of CVE-2026-46331, where an attacker exploits the page cache (pedit COW) to inject shellcode into the in-memory cached /bin/su binary, effectively gaining root privileges without on-disk modification.
This rule detects potential data exfiltration attempts by monitoring for network connections to URLs containing suspicious substrings (bit, onion, .cc, .su) over common web and DNS ports (53, 80, 443, 8080). It flags high-frequency unique connection attempts from a single device, which may indicate command-and-control (C2) traffic or data exfiltration over covert channels.
Detects evidence of CVE-2026-43503 (DirtyClone) exploitation, where an unprivileged user attempts to gain root access by corrupting the in-memory page cache of /usr/bin/su. The detection monitors for suspicious invocation of 'su -c /bin/sh' by non-root users and the subsequent spawning of root shells from an unprivileged parent process.
This rule detects endpoint DNS queries or network connections to the suspected phishing domain 'gasparinutrition.com' initiated by common web browsers or email clients. This provides visibility into potential user interaction with malicious sites that would otherwise be missed by email security gateways.
This rule detects potential Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI injection patterns in web request headers, process command lines, and syslog messages. It further identifies suspicious outbound network callbacks to known malicious infrastructure associated with these exploitation attempts.
Detects the execution of 'aws sts get-caller-identity' from unexpected or potentially suspicious parent processes such as Node.js, bash/sh, or IDE-related processes like VS Code or Amazon Q. This command is often used by developers to confirm identity, but when triggered from these contexts, it may indicate unauthorized access or exploration by an adversary operating within a development environment.
This rule detects activity associated with the malicious 'Search for perplexity ai' browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). It specifically identifies DNS queries and network connections to the malicious domain 'perplexity-ai.online' initiated by common web browser processes, as well as file system evidence of the extension's presence.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Detects exploitation attempts against Flowise by leveraging a case-sensitivity bypass in environment variable parsing. Attackers inject variants like 'node_options' into the environment, which bypasses security denylists, allowing the 'NODE_OPTIONS' variable to be set. This enables remote code execution (RCE) via the '--require' flag in child Node.js processes, alongside subsequent activities like marker file creation, registry-based persistence, or unauthorized outbound network connections from the Flowise service.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
Page 188 of 341