Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the suspicious execution of the Bun runtime spawned as a child process of Node.js or during npm package installation, which is a pattern observed in the Miasma/Mini Shai-Hulud supply chain attacks. It monitors for child processes named 'bun' or 'bun.exe' initiated by Node.js, or activities involving 'bun run _index.js' and 'node-gyp' which are characteristic of loader chains used to facilitate credential theft during package installation.
Detects anomalous file modifications to web-accessible directories (such as index.html, dist, public, or wwwroot) by common JavaScript execution environments including node.exe, bun.exe, or npm. This activity is consistent with post-compromise tampering of web assets as observed in the Miasma/Hades campaign, likely involving the abuse of stolen repository credentials to deploy malicious content.
Detects potential persistence attempts via cron job manipulation by unprivileged service accounts (such as www-data) or patterns indicative of the 'lambsys' threat, including usage of known writable temporary directories, non-interactive crontab installations, and aggressive execution schedules.
Detects potential unauthorized cryptocurrency mining activity by correlating process execution, network connections to known mining pools or C2 IPs, and the presence of known miner binaries in temporary directories. The rule calculates a confidence score based on the overlap of these behavioral indicators.
This rule monitors for the execution of the 'bun.exe' process specifically when it originates from a Node.js-related context (such as npm, node-gyp, or binding.gyp execution) or exhibits suspicious behaviors like executing payloads from /tmp directories. This pattern is often associated with supply chain attacks or malicious package execution within JavaScript development environments.
Detects outbound network connections to 'stitch-production.org' or connections by node/bun runtime processes to GitHub API or 'stitch-production.org', which may indicate command and control communication or data exfiltration.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the creation of an Amazon Q Model Context Protocol (MCP) configuration file. This file is used to define tools and resources for Amazon Q, and its creation could indicate a user configuring external tool access for the AI assistant or an adversary attempting to influence its capabilities.
This rule monitors process execution events for the 'aa-exec' utility, a tool often used in containerized environments (such as AppArmor) or specific runtime configurations, when invoked with specific command-line arguments (-p trinity, -p chrome, or -p flatpak). These patterns are indicative of specialized container or sandbox execution activities that may warrant investigation in specific enterprise environments.
Detects unexpected shell command execution spawned by the Amazon Q Developer VS Code extension processes (e.g., 'amazonq-lsp'). This activity is consistent with patterns related to the exploitation of CVE-2026-12957, involving the potential auto-execution of unauthorized commands via MCP (Model Context Protocol) server configurations or malicious inputs.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects anomalous child process execution (e.g., bash, sh, npx, node) spawned directly by AI coding assistants or IDE extensions (Claude Code, Cursor, Amazon Q). This behavior, specifically involving auto-executed configurations like mcp.json, is indicative of exploitation attempts targeting AI coding environments where remote code execution (RCE) can be achieved via untrusted configurations or injected prompts.
Detects the Amazon Q Developer language server or extension host spawning suspicious child processes (bash, sh, zsh, python, node) that execute commands involving AWS STS identity retrieval, external data exfiltration via network tools like curl/wget, or direct references to AWS credential environment variables. This pattern is indicative of potential Remote Code Execution (RCE) via malicious Model Context Protocol (MCP) auto-execution.
Detects the creation of GitHub Actions workflow files within the .github/workflows/ directory that mimic Dependabot naming conventions while containing suspicious indicators associated with the Miasma/Mini Shai-Hulud supply chain attack. Indicators include hardcoded secret references, specific operational markers like 'RevokeAndItGoesKaboom', and unauthorized OIDC token permissions.
Detects MYRA RAT masquerading as the legitimate 'systemd-userdbd' daemon by identifying processes with that name running outside expected system paths. It also identifies fileless execution patterns where Node.js or npm processes spawn memfd-backed executables, reference deleted files, or initiate processes using the 'systemd-userdbd' name, characteristic of the Miasma campaign.
Loader used in click-hijacking traffic distribution scheme
Loader used in click-hijacking traffic distribution scheme
Detects unauthorized cron job creation or modification associated with cryptominer persistence. The rule monitors for common persistence indicators such as referencing 'lambsys', 'isp.sh', or 'procq' within cron-related commands and shell execution patterns that suggest malicious automated tasks in Linux environments.
IoT botnet malware family used for DDoS and proxy infrastructure
Page 196 of 341