Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects instances where the Ghidra reverse engineering suite (or associated Java processes running Ghidra components) initiates suspicious child processes. This behavior is considered anomalous as standard reverse engineering activities in Ghidra should not require the execution of system administrative tools, interpreters, or networking utilities, which may indicate an attacker using a compromised development environment to launch secondary payloads or tools.
This rule detects potentially malicious activity associated with the RustDesk remote access tool. It monitors for two conditions: 1) RustDesk spawning suspicious child processes (e.g., shells, scripting engines, or network tools) that indicate post-exploitation behavior. 2) The RustDesk binary being executed from an unusual parent process, which may indicate session hijacking or unauthorized installation.
Detects unauthorized SSH-based lateral movement originating from a compromised Cisco SD-WAN vManage controller to vSmart or vBond components. The rule monitors for SSH sessions initiated by administrative users (admin, vmanage-admin) and subsequent unauthorized file permission modifications (chmod/chown) on sensitive system files and directories, such as SSH authorized_keys and system configuration files, which are indicative of post-exploitation activities.
Detects post-exploitation activities on Cisco SD-WAN Manager (vManage) systems. The rule identifies suspicious command execution patterns including shell spawning via SSH, use of administrative/backdoor accounts (troot), privilege escalation attempts using su, enumeration commands commonly used by attackers, unauthorized modification of sensitive system files (/etc/passwd, /etc/shadow), the use of specific malicious tenant-upload CLI operations, and outbound reverse-shell connections.
Detects network and process execution activity involving Google or Microsoft OAuth2 token endpoints from non-browser and non-trusted processes. This behavior is indicative of potential token theft or session hijacking attempts, where malicious tools (e.g., curl, python) are used to access authentication endpoints to bypass standard user interaction.
Detects potential remote code execution (RCE) attempts leveraging a vulnerability in the Nextcloud Movie preview provider (CVE-2026-8461). The detection identifies cases where the web server service user (www-data) unexpectedly spawns ffmpeg or ffprobe, followed by the immediate spawning of a command shell from these multimedia processing binaries, which is highly anomalous.
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
Detects execution of AryStinger or JDY malware as a secondary payload on Oracle PeopleSoft servers, likely following exploitation of CVE-2026-35273 by ShinyHunters. The rule monitors for processes matching these names or anomalous binaries spawned from within the PeopleSoft application directory that are not part of the legitimate application service suite.
Detects anomalous network and file activity associated with the libarchive ZIP size boundary bypass vulnerability (Exploitarium PoC). The rule identifies processes like 'debuginfod' or 'curl' interacting with specific /buildid/*/section/ endpoints via loopback interfaces, correlated with the creation of known PoC marker files or logs in temporary directories.
Detects the execution of known adversary-in-the-middle (AiTM) phishing frameworks, such as Evilginx or Modlishka, by identifying process names, paths, or specific command-line arguments (e.g., --phishlets, --proxy, --lure) used to initiate these proxy-based phishing sessions.
Detects evidence of the execution of a proof-of-concept (PoC) exploit targeting Next.js unstable_cache functionality. The rule monitors for the installation of canary versions of Next.js, execution of the PoC demonstration script 'run_demo.mjs', and the creation of a 'VULNERABILITY_CONFIRMED.marker' file, which are specific indicators associated with the exploitarium repository PoC.
Detects unauthorized processes (those not identified as standard web browsers) accessing browser profile directories (Local Storage or IndexedDB) associated with major AI platforms such as OpenAI, ChatGPT, Anthropic, and Copilot. This behavior is indicative of credential theft or session token exfiltration from local browser storage.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
This rule detects scenarios where an Oracle database process (or associated service processes) spawns potentially malicious OS-level child processes, such as shells, network utilities, or script execution. This behavior is highly indicative of abuse of Oracle features like DBMS_SCHEDULER or UTL_FILE to execute arbitrary commands, perform network reconnaissance, or stage exploit payloads.
This rule monitors process execution events for the presence of the Chisel network tunneling tool. It identifies Chisel by its executable names (e.g., chisel.exe, chisel_linux) and command-line arguments typical of a Chisel client or server configuration, including SOCKS proxy setups and known indicator ports.
Detects anomalous process execution where a non-privileged user attempts to execute /bin/su to transition to UID 0 (root) without a legitimate parent process (such as sudo, sshd, or login). This activity is indicative of the pedit COW (CVE-2026-46331) exploit, which involves poisoning the /bin/su page cache to achieve unauthorized privilege escalation via shellcode injection.
Detects outbound network traffic to api.telegram.org. This pattern is commonly observed in malware such as Sauron ransomware to establish command and control (C2) channels and perform data exfiltration by abusing the legitimate Telegram Bot API.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
This rule detects potentially malicious shell execution (e.g., bash -i, /dev/tcp/ reverse shells, netcat) spawned directly or indirectly by common media processing applications such as ffmpeg, ffprobe, jellyfin, or nextcloud. It identifies when these applications initiate shell processes or execute command lines that exhibit suspicious behavior or access specific media-related paths commonly targeted for abuse.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
Page 201 of 347