Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects potentially malicious reconnaissance and execution activity. On Linux, it monitors for network and system information discovery utilities (e.g., ifconfig, netstat, ip) executed by shells or remote access daemons. On Windows, it monitors for the use of WScript, CScript, WMIC, and WBEMTest in potentially suspicious ways, including the use of WMI for command execution.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
Detects unauthorized file operations (Creation, Modification, Rename, Deletion) on sensitive browser-related credential files (e.g., Login Data, Cookies, key4.db) by potentially unauthorized or suspicious processes identified by name.
Detects unauthorized file operations (Creation, Modification, Rename, Deletion) on sensitive browser-related credential files (e.g., Login Data, Cookies, key4.db) by potentially unauthorized or suspicious processes identified by name.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Hunting rule for Atomic Red Team T1090.001 test "Connection Proxy" (Proxy: Internal Proxy). Correlate with additional signals before alerting.
Hunting rule for Atomic Red Team T1090.001 test "Connection Proxy" (Proxy: Internal Proxy). Correlate with additional signals before alerting.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
This rule detects the execution of processes in CI/CD environments (such as runners, Jenkins, or GitLab) where the environment variable 'GEMINI_TRUST_WORKSPACE' is explicitly set to 'true'. This configuration is often used to grant elevated trust or access to workspace files during CI/CD workflows, which could be abused by an attacker to execute arbitrary code or access sensitive data if they can control the pipeline execution or workspace state.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects network activity associated with the BadBlocker for YouTube browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk). The rule identifies DNS queries and outbound network connections to known command-and-control (C2) domains (api.adblock-for-youtube.com, get.adblock-for-youtube.com) used by the extension to exfiltrate session cookies and other sensitive browser data.
Detects outbound network traffic from browser processes to known BadBlocker extension command-and-control infrastructure (api.adblock-for-youtube.com or get.adblock-for-youtube.com), followed by subsequent outbound HTTPS connections to arbitrary external domains. This sequence is indicative of malicious browser extension activity involving the exfiltration of session cookies or authentication tokens from the victim's browser.
Detects post-exploitation activities on SD-WAN appliances, including unauthorized tenant list uploads related to CVE-2026-20245, creation of unauthorized 'troot' accounts in sensitive system files, staging of system files, unauthorized permission modifications via chmod/chown, and privilege escalation attempts using su.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
This rule detects potential SSH brute force attacks by identifying high-frequency authentication failures from sshd logs (more than 10 failures in 5 minutes) and rapid, potentially automated connection attempts on port 22 (more than 20 connections in 1 minute) originating from the same source IP on Linux systems.
Detects the use of legitimate command-line utilities such as rclone, AWS CLI, AzCopy, curl, and wget to upload data to cloud storage endpoints, which is a common technique used for data exfiltration.
This rule monitors incoming TCP traffic on port 22 (SSH) and alerts when a single source IP address exhibits an excessive number of authentication attempts within a 60-second window, which is indicative of a brute-force attack against the SSH service.
Detects outbound network connections from endpoint processes to domains associated with a malicious browser extension. The extension is known to fetch scriptlets that enable main-world JavaScript injection and potential credential theft (e.g., document.cookie).
Detects attempts to exploit the Shellshock vulnerability (CVE-2014-6271) by inspecting HTTP request headers for the characteristic function definition syntax '() { :;'. This pattern is commonly used in malicious payloads to trigger command execution via environment variables in CGI scripts.
Page 202 of 341