Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,214
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,781
7,128
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects HTTP requests containing serialized PHP objects in the Cookie header matching patterns associated with Zend Framework or Laminas gadget chains, characteristic of PHP object deserialization exploitation (e.g., PHPGGC style).
Detects PHP out-of-memory fatal errors (Allowed memory size exhausted) on hosts where memory_limit=-1 has been configured as mitigation. On these hosts, memory is unlimited, so this error indicates potential configuration tampering or an attack.
Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios
Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance.
Detects an AhsayCBS / Tomcat / Java web service process spawning a
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
This detection identifies outbound IPv4 and IPv6 network connections to non-standard ports that may indicate suspicious network activity, unauthorized communication, or potential command-and-control (C2) traffic.
It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.
It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects endpoint network connections made to known staging IP addresses often associated with data exfiltration or staging activities.
Detects the creation, modification, or renaming of Model Context Protocol (MCP) configuration files (such as mcp.json or claude_desktop_config.json) by shells, scripts, or downloaders, which may indicate unauthorized tool integration or persistence attempts.
Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects VPN connection events where the client hostname contains the string 'kali', which may indicate the use of a penetration testing operating system or a suspicious device connecting to the corporate network via Palo Alto Networks GlobalProtect.
Detects web server processes (such as nginx, apache2, httpd, uwsgi, gunicorn, php-fpm) spawning command-line utilities typically used for system and user discovery (such as id, whoami, groups, hostname, uname, netstat, ps, etc.), which often indicates web application exploitation and remote code execution.
Detects first-seen Model Context Protocol (MCP) server packages executed via package runners (such as npx, bunx, uvx, pipx) across a limited number of devices within a 24-hour window, potentially indicating software supply chain risks or malicious MCP integrations.
Detects a sequence where an UpdraftCentral management request is made to a WordPress site followed by plugin installation or user creation requests from the same source within a 30-minute window, potentially indicating unauthorized plugin installation or webshell deployment via compromised management endpoints.
Detects host-side telemetry indicating Cairn agent worker artifacts, including specific process command line terms, tsec skill files and environment variables, combined with network connections to OpenRouter from the same host.
Detects a sequence of events on a Linux device where a sudo command execution is followed within 15 minutes by a Perl process executing base64 decoding commands within the same SSH session.
Detects a web server process (apache2, httpd, php-fpm) spawning a Unix shell (dash/sh) that executes discovery commands such as id, whoami, hostname, or find. This is the durable post-exploitation signature of the wp2shell WordPress pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137), where a malicious plugin or webshell executes commands through the web stack.
This rule detects suspicious driver loading from user-writable paths, kernel driver service creation, disabling of driver signing, loading of Linux kernel modules, and the usage of LD_PRELOAD for rootkit functionality.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Page 2 of 340