Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects malicious PHP web shell patterns (e.g., base64_decode, system, eval, passthru) within the WordPress plugins directory. This often indicates the presence of a trojanized plugin update or unauthorized file modification following a supply chain compromise.
Detects obfuscated PHP code within the Admin Menu Editor Pro plugin, specifically targeting indicators associated with the supply chain compromise of versions 2.35 and 2.36. The rule searches for common PHP execution functions used in web shells within the context of the vulnerable plugin directory.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects the presence of specific versions (2.35 and 2.36) of the Admin Menu Editor Pro WordPress plugin, which were reported to be distributed as trojanized versions via a compromised update infrastructure.
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
This rule detects the installation or presence of ten identified malicious npm packages associated with the indexed-btree/sorted-btree typosquatting campaign. It monitors command-line activity for 'npm install' commands, package name resolution, and entries within 'package.json' files.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
This rule detects potential API abuse by identifying high-frequency API calls using the 'python-requests' user agent that occur within a short time window (120 seconds) immediately following a successful device code authentication event. This behavior is indicative of automated token theft or session hijacking where an adversary attempts to perform unauthorized actions quickly using tokens obtained via device code phishing.
This rule identifies successful user sign-ins (ResultType 0) originating from specific Autonomous System Numbers (197540, 216154) where Multi-Factor Authentication (MFA) was not required or not recorded, and where Conditional Access policies either did not apply or succeeded without enforcing MFA.
Detects the presence of natural-language self-narration in code comments within Python or SQL scripts. This pattern is indicative of LLM-driven agentic execution, where automated agents narrate their own malicious actions, such as enumeration, data exfiltration, or database manipulation, as observed in the JADEPUFFER campaign.
Detects anomalous authentication or API access patterns where a single user account interacts with both Salesforce and ServiceNow environments simultaneously from multiple distinct source IP addresses. This behavior is indicative of credential abuse or account takeovers consistent with multi-platform SaaS targeting.
Detects high-volume, systematic API requests to AI inference endpoints from a single user ID, which may indicate automated model extraction or scraping attacks against AI services.
Flags an MCP request when its routing label and the instructions inside do not match. For example, the label points to Task A, but the request inside asks for Task B. This could be an attack attempt or a software mistake; the alert alone does not mean unauthorized access succeeded.
Detects the creation or use of known backdoor accounts ('p2pwn', 'p2password') on Dahua surveillance devices, which are often utilized by adversaries to maintain unauthorized access to compromised hardware.
Detects anomalous git operations initiated by AI coding agents (e.g., Claude, Copilot, Gemini-cli) that suggest potential supply chain tampering. The rule identifies attempts to checkout via a raw SHA-1 hash, git refname ambiguity warnings, or mismatches between the pinned plugin manifest commit SHA and the actual HEAD SHA resolved during operations, which may indicate a malicious substitution of code during dependency installation or updates.
Detects compromised versions (2.35 and 2.36) of the 'Admin Menu Editor Pro' WordPress plugin that were distributed via the official update infrastructure. These versions include embedded web shell code, as indicated by the presence of both plugin identification strings and common PHP execution or command-line utility functions used in backdoors.
Detects the presence of PHP web shell code within specific versions (2.35/2.36) of the Admin Menu Editor Pro plugin. This rule targets malicious files introduced via a supply chain compromise of the plugin's update distribution channel, specifically looking for common PHP obfuscation and execution functions associated with web shells.
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Page 20 of 52