Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
IoT botnet malware family used for DDoS and proxy infrastructure
IoT botnet malware family used for DDoS and proxy infrastructure
IoT botnet malware family used for DDoS and proxy infrastructure
This rule detects two stages of a potential exploitation chain targeting vLLM multimodal endpoints. Stage 1 identifies POST requests to vLLM API endpoints that contain 'video_url' in the request context, which could indicate an attempt to exploit CVE-2026-22778. Stage 2 detects post-exploitation activity by looking for unexpected child processes (like shell interpreters or download utilities) spawned from vLLM or Python inference processes, suggesting successful remote code execution.
Detects unexpected child processes (e.g., shell, Python, network utilities) spawned from vLLM or Python worker processes, or suspicious file/network activity related to vLLM/Python processes. This rule aims to identify potential exploitation of CVE-2026-22778, an FFmpeg JPEG2000 heap overflow vulnerability, which could lead to arbitrary code execution within AI/ML environments.
Linux BPFDoor iptables Redirect
Gravwell
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Fraud framework powering scam domains for crypto and gambling schemes
Detects the execution of PowerShell or Bash commands, potentially for implant delivery, spawned from Visual Studio Code extension host processes (node.exe, code.exe, code-server, cursor). This rule specifically looks for command-line patterns associated with the GLASSWORM.WASM threat, such as 'irm', 'iex', 'curl -fsSL', 'Invoke-Expression', 'IEX', or combinations of 'powershell -Command', 'curl -fsSL', and 'bash -c'.
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
This rule detects potentially malicious use of Managed Service Provider (MSP) credentials by correlating network or explicit authentication events (Logon Types 3, 9, or 10) occurring outside of typical business hours or originating from VPN/private network ranges, with concurrent SSH process activity on the same host. This pattern suggests an adversary may be using compromised credentials to move laterally or persist within an environment via SSH.
Detects unauthorized modifications to cron jobs or RC scripts on Linux and BSD edge appliances, which is a persistence technique observed in the VerdantBamboo BRICKSTORM campaign. The rule flags suspicious file modifications in persistence-related directories, excluding activity from legitimate package managers.
This rule detects suspicious use of sudo, modification of the sudoers file, or privilege escalation patterns specifically targeting edge network appliances (e.g., pfSense, Synology, Egnyte). It monitors for commands like sudo tee, sudo -l for permission enumeration, or the introduction of NOPASSWD entries, which are common indicators of persistence or privilege escalation attempts by service accounts.
Page 197 of 341