Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects instances where the FFmpeg or FFplay multimedia frameworks spawn unexpected child processes. This behavior is indicative of successful exploitation of the RASC/DLTA codec heap overflow vulnerability, where a malicious media file triggers arbitrary code execution.
Detects instances where Claude AI-related processes (claude, claude-code) or Node.js processes associated with Claude launch suspicious commands or scripts such as setup scripts, base64-encoded commands, shell interactions, or external network connections. This behavior is indicative of potential supply chain compromise or malicious use of AI-assisted coding tools to execute arbitrary system operations.
Detects the spawning of shell or scripting processes from IDEs, code editors, or AI-assistant processes (e.g., 'claude', 'node'). The rule specifically flags potential reverse shell patterns or dangerous command-line flags often used during development or exploitation, such as '--dangerously-skip-permissions'.
Detects Node.js processes ('node' or 'node.exe') spawning other processes or executing commands that reference suspicious file paths, such as '.libcache.so' or '.sh.local', or utilizing risky syscall patterns like 'memfd_create' or 'fexecve'. This pattern is often associated with malicious npm post-install scripts or supply chain attacks.
This rule detects when the node.exe process initiates an outbound network connection to a specific set of non-standard, often high-numbered ports (8443, 8445, 8453, 5555, 56001-56003) over the public internet. This behavior is often indicative of potential command and control (C2) communication, reverse shells, or malicious scripts executing within a Node.js runtime environment.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.
Detects the execution of the fscan network scanner binary, its use with common scanning arguments, or any network communication with the known staging IP address associated with the fscan deployment.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Detects the execution of a process named 'packet_edit_meme' on Linux systems, which is often indicative of specific malware or unauthorized tool usage.
Detects the execution of the 'aa-exec' process with specific command-line arguments ('trinity', 'chrome', or 'flatpak') that are often associated with malicious tools, persistence, or bypass techniques.
Detects instances where code editors like Cursor or Claude execute shell commands or CLI tools often used for configuration, network activity, or credential interaction. This pattern may indicate malicious exploitation of editor configuration files (e.g., MCP configuration) or unauthorized use of the editor environment to execute shell commands.
Detects execution of the tc (traffic control) utility with pedit actions by non-root users. This pattern is indicative of exploitation attempts targeting the Linux kernel act_pedit subsystem (CVE-2026-46331), which can lead to page cache corruption and local privilege escalation.
Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.
Detects the malicious execution of the Bun JavaScript runtime associated with the Miasma supply chain attack. The rule identifies suspicious child processes spawned from development directories (like node_modules) that execute Bun to read sensitive configuration files, SSH keys, and cloud credentials typically targeted for exfiltration.
Detects reconnaissance and credential harvesting activities associated with the Lambsys cryptominer campaign. The rule monitors for unauthorized enumeration of SSH directories, key files, and the use of SSH utilities for lateral movement, specifically triggered by the presence of 'isp.sh' or 'lambsys' in command arguments or related patterns.
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
Detects the use of 'unshare' or 'ip' commands by non-root users to manipulate Linux namespaces (e.g., user, network, or xfrm namespaces). These commands can be used to bypass security restrictions, facilitate container escapes, or perform local privilege escalation by exploiting vulnerabilities in the Linux kernel namespace subsystem.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Page 211 of 341