Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Sshpass Lateral Movement
YARA-L
Detects sshpass automation usage by administrative accounts
This rule monitors DNS query logs for requests to specific domains associated with malicious activity. It aggregates these requests by endpoint to identify potential command and control (C2) communication or beaconing behavior.
Detects indicators of exploitation attempts targeting the c-ares asynchronous DNS library, specifically focusing on Use-After-Free (UAF) vulnerabilities. The rule monitors for the presence of known proof-of-concept (PoC) file artifacts, execution of processes using specific command-line flags associated with c-ares exploit research, suspicious shell/calculator spawning from common network-enabled applications (curl, node, python), and anomalous high-frequency DNS-over-TCP traffic patterns.
Detects network requests from the Firefox browser process containing URI patterns and parameters often associated with data exfiltration or browser-based reconnaissance, including suspicious leakage parameters and local proxy/loopback communication attempts on non-standard ports.
Detects potential exploitation attempts targeting the Flowise 3.1.2 Custom MCP (Model Context Protocol) stdio interface. The detection monitors for the bypass of environment variable validation where lowercase 'node_options' is used to circumvent security controls blocking 'NODE_OPTIONS', potentially allowing unauthorized code execution via '--require'. It also alerts on the presence of associated PoC artifacts and anomalous outbound network activity from Flowise processes.
Detects the presence and execution of the 'mybb_limited_acp_to_admin' PoC script, as well as suspicious child process creation originating from web server or PHP processes when the command line includes 'admincp'. This is indicative of potential web exploitation or the use of a web shell within the MyBB Administrative Control Panel environment.
Detects DNS lookups or network connections from common web browsers to known malicious or suspicious domains (short.gy and chongdaotang.net), which are associated with legal-threat lure phishing campaigns designed for credential harvesting.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects potential container escape attempts leveraging path traversal vulnerabilities in the 'docker cp' command (e.g., CVE-2026-55199). The rule identifies file creation events triggered by docker processes where the target file path is outside the expected Docker root or temporary directory structures, suggesting an effort to write files to arbitrary locations on the host filesystem.
Detects the Flowise application launching a Node.js child process with a --require flag, which indicates an attempt to exploit an environment variable case-sensitivity bypass (e.g., node_options vs NODE_OPTIONS) in the MCP environment to preload malicious JavaScript code.
Detects the execution or presence of identified exploit harness binaries and scripts associated with CVE-2026-55200, an RCE vulnerability in libssh2. The rule monitors process launches for specific filenames and command-line arguments indicative of proof-of-concept or exploitation tooling from the 'exploitarium' repository.
Detects the spawning of shell or scripting processes from IDEs, code editors, or AI-assistant processes (e.g., 'claude', 'node'). The rule specifically flags potential reverse shell patterns or dangerous command-line flags often used during development or exploitation, such as '--dangerously-skip-permissions'.
Detects the creation or modification of shell script files within known Linux system persistence directories ('/etc/profile.d/' and '/usr/local/lib/') that contain specific naming patterns (' .sh.local' or '.cache-update.sh'). This activity often indicates an attempt to establish persistence or inject code that executes upon user logon or system initialization.
Detects the spawning of unexpected child processes such as shell interpreters, download tools, or package managers from vLLM Python serving processes. This activity could indicate a successful exploitation of a vulnerability like CVE-2026-22778, leading to remote code execution through a function pointer overwrite.
Detects outbound network connections from workstations or servers to common message broker ports (MQTT 1883/8883, AMQP 5672). These protocols are sometimes abused for command-and-control (C2) communication, as they allow for pub/sub messaging patterns that can blend into legitimate network traffic.
This rule detects potentially unauthorized installation of extensions in Visual Studio Code (VSIX) or plugins in JetBrains IDEs (IntelliJ, PyCharm, WebStorm). It flags installations that do not originate from verified official marketplaces, which may indicate the manual installation of malicious or supply-chain compromised development environment extensions.
Detects network activity originating from popular web browsers (Chrome, Chromium, Edge, Brave) directed towards known malicious or suspicious browser extension domains. This rule flags beaconing, API requests, and remote configuration fetches associated with potentially malicious or unwanted browser extensions.
Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.
Detects suspicious activity on Cisco SD-WAN infrastructure (vManage, vSmart, vBond) associated with unauthorized configuration changes, potential exploitation of CVE-2026-20245, rogue account creation, and anti-forensic behaviors.
Detects GitHub Actions runner processes (e.g., node, bash, python) accessing sensitive CI/CD environment variables (GITHUB_TOKEN, NPM_TOKEN) followed within 30 seconds by an outbound network connection to a non-GitHub domain. This pattern is indicative of potential secret exfiltration by compromised CI/CD pipelines or malicious build steps.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Page 202 of 347