Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation of an interactive shell (e.g., bash -i, Python pty, socat) on a Linux host that simultaneously initiates an outbound network connection to an RFC-1918 private IP address. This pattern is characteristic of attackers using reverse shells for command and control or internal network reconnaissance, specifically matching behaviors associated with the MYRA RAT shell-pty plugin.
Detects outbound network connections to a known malicious IP (83.142.209.214) associated with Lambsys cryptominer activity. The rule specifically monitors for HTTP POST requests to '/status.php' or '/setup_status.php' using the default 'Go-http-client/1.1' User-Agent, indicating a C2 beaconing pattern.
Detects high-volume credential stuffing attacks targeting the WordPress 'wp-login.php' endpoint. The rule monitors for multiple geographically distinct source IP addresses submitting HTTP POST requests to the login page within a 2-minute window. It specifically identifies traffic patterns associated with common infostealer-harvested credential campaigns (such as Vidar, Stealc, or DanaBot) by matching a specific User-Agent string associated with the campaign.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects the deployment and execution of the MeshCentral remote management agent on PeopleSoft servers, which is indicative of unauthorized access by the ShinyHunters threat group. The rule triggers on the execution of the meshctrl.js script using the RunCommand function with suspicious loopback WebSocket connections, or the direct execution of the meshagent binary from within the /opt/meshcentral/ directory.
Detects suspicious processes (e.g., node.exe, chost.exe, python) accessing sensitive credential files and subsequently exfiltrating data to the Telegram Bot API via HTTPS POST requests within a 10-minute window. This behavior is indicative of infostealer malware, such as those observed in the Friday Harvest campaign, harvesting and exfiltrating system data.
Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Detects malicious Python or JavaScript package archives (such as those used in dependency confusion attacks) that contain obfuscated code execution logic (base64 encoded commands) within package installation hooks (setup.py), or those embedding suspicious binary executables (PE/ELF headers) within the package structure.
Detects outbound HTTPS traffic from a web server to api.telegram.org. This pattern is indicative of the Montana Empire phishing kit using the Telegram Bot API for command and control (C2) communication, allowing the adversary to exfiltrate stolen data or receive instructions.
Detects network connections from a host to the api.adblock-for-youtube.com domain at the /api/v2/rules endpoint. This behavior is associated with the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves remote JavaScript scriplets for rule updates, which can be a vector for unauthorized code execution if the domain is compromised or used maliciously.
Detects the 'BadBlocker' Adblock for YouTube browser extension communicating with its command-and-control infrastructure to fetch and execute arbitrary scriptlets in the MAIN JavaScript world. By injecting directly into the page context, the extension gains unauthorized access to the DOM, user browsing sessions, and sensitive form data.
This rule monitors for unauthorized changes to sensitive system, authentication, and configuration files, as well as the deletion or truncation of logging artifacts on SD-WAN appliances. This activity is indicative of an adversary attempting to modify credentials, evade detection, or clear their footprint by tampering with security-critical paths.
Detects process command lines containing references to sensitive Unix system files (/etc/passwd or /etc/shadow) specifically when accessed within or in association with a /troot/ directory path. This pattern is often indicative of an adversary performing reconnaissance or credential dumping.
This rule detects network connections and DNS requests to specific domains associated with Unistream SDK and other known BadBlocker malware infrastructure, often linked to malicious browser extensions such as Adblock for YouTube and related variants.
Detects SSH network connections initiated by common administrative service accounts 'vmanage-admin' or 'troot' using the ssh or sshd process. This pattern may indicate unauthorized use of these service accounts or anomalous remote access behavior.
This rule detects network connections or DNS queries originating from an endpoint towards domains or IP addresses associated with BlueKit command-and-control (C2) infrastructure, including TLDs (pk, ws, cc, su) and onion-based addresses. This activity is indicative of potential malware communication or C2 beacons.
This rule monitors DNS query logs for attempts to resolve domains associated with 'rrweb' or 'rrweb-snapshot'. These libraries are legitimate tools for session recording and DOM snapshotting but have been increasingly observed in malicious activity, specifically in web-based credential theft, automated session hijacking, or exfiltration of sensitive user activity via session recording.
Detects the execution of a malicious Node.js process using a fake ESLint loader named 'vscode-eioesocxetd.js'. This malware persists by modifying the global 'require' function and setting the 'global['!']' property to ensure its presence across process restarts, typically masquerading within npm package directories.
Detects HTTP GET requests to api.adblock-for-youtube.com to retrieve scriptlet rules. This endpoint is used by various browser extensions to fetch dynamic configuration updates, which can potentially facilitate MAIN-world JavaScript injection.
Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.
Page 215 of 341