Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects DNS queries for known StegoAd command-and-control infrastructure domains, which are used as proxy relays and exfiltration endpoints.
This rule detects network connections from internal hosts to a list of known malicious IP addresses associated with the Payroll Pirate campaign (attributed to Storm-2755 and Storm-2657). Identifying these connections indicates potential communication with adversary-controlled infrastructure.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
This rule monitors for suspicious activity on Linux-based SD-WAN appliances (e.g., vManage, vBond, vSmart) including unauthorized file deletion, log tampering, and credential backup manipulation. It specifically flags operations like removing system logs, deleting configuration/tenant files, or copying sensitive files like /etc/passwd and /etc/shadow, which are common indicators of post-exploitation activity or attempts to hide malicious footprints.
Detects network communication to the malicious domain 'mitarchive.info' from common web browsers (Chrome, Edge, Firefox, Brave). This domain is associated with the StegoAd browser extension, which intercepts Google and WordPress login flows to exfiltrate stolen credentials and 2FA codes.
Detects the execution of Gitea/Act runner or Docker containers with dangerous configurations that allow host-level access, such as privileged mode, host PID/IPC namespaces, or disabled security profiles (AppArmor/Seccomp). These configurations are often used to escape container isolation or execute commands on the underlying host.
Detects instances where the 'splunkd' process acts as a parent to common command-line interpreters (e.g., bash, powershell, python) or network utilities (e.g., curl, wget, netcat, nmap). This behavior is highly suspicious as the Splunk daemon should not typically invoke shells or network tools, and may indicate exploitation of the Splunk environment, lateral movement, or unauthorized task execution.
Detects suspicious or unexpected child processes spawned from a Ghidra JVM environment. This rule is designed to monitor for potential Remote Code Execution (RCE) or Arbitrary Code Execution (ACE) attempts targeting Ghidra, where the application environment is abused to launch system shells, interpreters, or common attacker tools.
Detects attempts by a user or process to clear audit logs, system logs, or command history, often used by adversaries to cover their tracks on a compromised system. The rule monitors for file deletion (rm, shred), content truncation (truncate), selective line removal (sed -i), and shell history suppression (HISTFILE=/dev/null, history -c) against sensitive log and history paths.
Detects attempts to perform a container escape using path traversal via the 'docker cp' command. This rule monitors for malicious directory traversal sequences, the creation of specific artifacts used in known PoC exploits for container escapes, and the subsequent execution of scripts or shell interpreters by container management processes.
Detects potential exploitation of ImageMagick vulnerabilities where Ghostscript delegates are used to achieve arbitrary code execution. The rule monitors for suspicious Ghostscript command-line arguments (e.g., missing or disabled -dSAFER), child process creation (spawning shells or interpreters), execution of network tools, unauthorized file modifications with script/binary extensions, and outbound network connections initiated by Ghostscript processes.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity is often used by adversaries to establish persistence on compromised WordPress sites by injecting malicious code.
Detects cron-based watchdog persistence installed by lambsys.elf as part of the CVE-2026-33017 Langflow cryptominer campaign. The malware writes a per-user crontab via crontab stdin firing every 5 minutes, checking for lambsys via pgrep and re-downloading from C2 if absent, logging to /var/tmp/check_process.log.
Detects file creation or modification events associated with the known malicious Chromium extension 'Search for perplexity ai' (ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for the installation of the extension and the creation of its declarativeNetRequest rule files (perplexity-rules.json, bing-rules.json, google-rules.json), which are used to hijack browser search queries and redirect them to a typosquatted domain.
This rule detects potential rogue SD-WAN peering attempts by correlating successful SSH public key authentication using 'vmanage-admin' from known malicious IPs with subsequent network activity on SD-WAN control plane ports (e.g., 48373 for OMP, 830 for NETCONF). It also flags logs containing references to an 'evil_tenant.csv' artifact, which is associated with adversary persistence or unauthorized configuration management in SD-WAN environments.
Detects unauthorized persistence mechanisms on Cisco SD-WAN management plane nodes (vManage, vSmart, vBond). The rule monitors for modifications to SSH authorized_keys files, execution of commands like ssh-keygen or user management utilities, and SSH authentication events or configuration changes (e.g., PermitRootLogin) indicative of backdoored access.
Detects multiple failed SSH login attempts from a single source IP address, indicating a potential brute force attack. The rule identifies 'Invalid user' or 'Failed password' messages in syslog from the 'sshd' process and groups them by source IP and time to count unique attempted users and total attempts. A threshold of more than 5 attempted users from a single source IP within a 10-minute window triggers an alert.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
This rule detects activities indicative of a Docker container escape, specifically targeting the 'docker cp' path traversal vulnerability. It monitors for suspicious command-line patterns involving path traversal sequences ('../'), execution of shells or common utilities from container-related processes (dockerd, containerd, etc.), and the presence of known proof-of-concept artifacts or files written outside the expected container boundary.
Detects the use of npm to install known malicious npm packages, which is indicative of a supply chain compromise attempt via typosquatting or malicious dependency injection.
Detects potentially malicious container escape or privilege escalation attempts initiated by Gitea act runner processes. This includes the spawning of 'nsenter', the use of dangerous Docker flags that provide host-level access (such as host PID/IPC namespaces, all capabilities, or disabled security mechanisms), and the spawning of shells inside containers configured with namespace-entering commands.
Page 200 of 347