Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of known Command and Control (C2) frameworks such as Sliver, Havoc, SparkRAT, or VShell from common suspicious temporary or staging directories (temp, tmp, appdata, programdata). This rule monitors process creation events to identify the presence of these unauthorized remote access tools.
Detects the use of BPF syscalls by non-root processes or the execution of BPF-related utilities (bpftool, bpfcc) from an interactive shell. This behavior is often associated with the ShadowGuard rootkit and potential BPF-based backdoor activity, which leverages BPF programs for stealthy system monitoring or command execution.
This rule monitors for suspicious Linux kernel operations, including the loading of BPF programs via bpftool or system calls, and attempts by debugging or tracing tools to interact with processes using forceful termination signals. It also includes an anomaly detection branch that identifies processes with active network connections that are missing from the system process list, which may indicate process ghosting or hiding techniques.
Detects repeated outbound network connections (HTTPS or HTTP) originating from QEMU emulator processes (qemu-system-x86_64 or qemu-system-i386). This activity is indicative of C2 beaconing or post-exploitation traffic originating from a virtualized guest hidden on a host system.
Detects unauthorized access to sensitive developer credential files and browser credential stores, typical of the IronWorm Rust-based infostealer. The rule monitors processes that are not known developer or browser tools as they read paths associated with AWS, SSH, Kubernetes, Docker, browser login data, and cryptocurrency wallets.
Detects miner binaries and watchdog scripts associated with the CVE-2026-33017 Langflow cryptominer campaign being staged in hidden directories under /var/tmp, specifically /var/tmp/.xlamb/ and related files used to evade detection. The rule looks for file events or process events where the folder path or file name matches known indicators like '/var/tmp/.xlamb', '/var/tmp/init_rmount', 'lambsys', 'lambsys.elf', or 'init_rmount', or if the process command line contains these paths/filenames.
Detects HTTP requests that reference or serve the 'cors_exploit_poc.html' file, which is associated with the MexicanMafia (Operation Escaneo) actor's method of exploiting Cross-Origin Resource Sharing (CORS) misconfigurations. This exploit attempts to hijack active administrative sessions by leveraging CORS with 'withCredentials=true'.
Detects the unauthorized exfiltration of SSL private key files using Netcat to a known malicious C2 IP address (62.171.185.97). The rule monitors process execution commands that include specific file names associated with certificate harvesting or extraction tools being piped or transmitted over the network.
Detects instances where 'node.exe' or 'node' initiates the deletion of 'setup.cjs' from the 'node_modules/easy-day-js' directory. This includes both direct file system deletion (fs.rmSync) and shell-based deletion commands (e.g., 'del /f', 'rm -f') executed by 'node.exe'. This activity is indicative of potential malicious behavior, possibly related to supply chain attacks or post-exploitation cleanup.
Detects the execution of portable Impacket tools ('mini_imp'), including psexec.py, secretsdump.py, and ntlmrelayx.py. This activity is indicative of potential credential harvesting, remote service execution, or NTLM relay attacks, as observed in the MexicanMafia 'Operation Escaneo' campaign.
This rule detects potential exploitation of SAP Remote Function Call (RFC) mechanisms, specifically targeting abuse of SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT which allow execution of OS commands via SAP. It identifies the execution of known malicious SAP-related scripts, suspicious OS commands (such as whoami, reading /etc/passwd or /etc/shadow) spawned by SAP work processes, and command line activity originating from privileged SAP service accounts.
This rule detects suspicious activity on Oracle database hosts, including the spawning of unexpected child processes from Oracle service binaries (such as cmd.exe or shells), the creation or access of known exploit-related script filenames, and the use of UTL_FILE to write files with suspicious extensions to temporary directories, which are patterns indicative of exploitation attempts like DBMS_SCHEDULER remote code execution or data exfiltration.
Detects instances where a Node.js process spawns the 'crontab' utility, likely to modify user cron jobs. This is a common technique used by attackers to achieve persistence by scheduling periodic execution of malicious scripts or reverse shells.
Detects instances where a node or node.exe process accesses common shell history files (such as .bash_history, .zsh_history, etc.). This behavior is often associated with unauthorized access to command history, which may contain sensitive information like credentials or configuration details.
Detects evidence of the MYRA RAT attempting to establish persistence via the LD_PRELOAD environment variable. This is achieved by creating or modifying malicious shared libraries (e.g., .libcache.so) and configuring system startup files (e.g., /etc/profile.d/.sh.local) to ensure the library is loaded by the dynamic linker on startup.
Detects instances where a Node.js process accesses, modifies, or creates files within web browser extension directories. This behavior is indicative of unauthorized access to sensitive browser data, such as extension configurations, authentication tokens, or stored secrets.
Detects HTTP requests where the URI or request body contains indicators of internal network references (e.g., localhost, 127.0.0.1, or RFC 1918 private IP address ranges). This pattern is consistent with Server-Side Request Forgery (SSRF) attempts, where an attacker tries to force a vulnerable web application to perform unauthorized requests to internal resources.
This rule detects potentially malicious activity within Linux environments or containers where a single user context concurrently performs credential hunting (via environment variable dumping or accessing .env files) and terminates processes associated with known cryptocurrency miners or competing malicious actors. This behavior is highly indicative of a cryptojacking infection or a malicious actor clearing out existing resource-hijacking threats.
Detects Node.js processes accessing common shell history files or PowerShell history logs. This behavior is indicative of infostealer malware, such as those targeting developers, attempting to extract credentials or command history from the local filesystem.
Detects instances where Node.js or NPM processes (or their parent processes) access sensitive files such as SSH private keys, AWS credentials, environment files, or configuration files containing secrets. This behavior is often associated with infostealers or malicious scripts exfiltrating credentials from developer environments.
Detects malicious npm package behavior where a postinstall lifecycle hook uses 'npm pack' or similar commands to overwrite local node_modules contents with a newer version, a technique used by packages like 'decimal-format-utils' to bypass static analysis.
Page 207 of 347