Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects evidence of the MYRA Linux RAT executing payloads filelessly from memory using memfd_create and fexecve. The rule flags suspicious processes masquerading as systemd-userdbd, particularly when spawned from Node.js environments or associated with malicious packages like apintergrationpost or .libcache.so artifacts.
This rule monitors for suspicious file operations on Cisco vManage, vSmart, and vBond network devices. It detects attempts to delete system logs, unauthorized access or copying of sensitive system files (such as /etc/passwd or /etc/shadow), and the presence of suspicious strings in command lines that may indicate anti-forensic activity or the creation of rogue accounts.
This rule detects potentially malicious browser activity by monitoring for Google Chrome outbound network connections to known command-and-control (C2) domains associated with malicious browser extensions (e.g., BadBlocker). It also flags the installation or loading of specific, known-malicious browser extension IDs on endpoints.
This rule detects potentially malicious activity related to the npm ecosystem. It identifies Node.js processes accessing .npmrc files (which contain authentication tokens) followed by immediate outbound network communication. Additionally, it detects suspicious command-line patterns associated with automated npm publishing (indicative of worm-like propagation) and the presence of npm credentials in the environment or command lines of non-npm processes.
Detects suspicious usage of the 'curl' command-line tool to perform PUT or POST requests with binary data to specific paths, potentially indicating data exfiltration or command and control communication. The rule excludes common web browsers as initiating processes to reduce false positives.
Detects suspicious child processes spawned by VS Code extension hosts (node.exe, code.exe, code-server, cursor) that indicate potential abuse, possibly related to WASM syscall/js bridge exploitation. The rule specifically looks for common command-line patterns used for downloading and executing payloads, such as those seen in GLASSWORM WASM loader attacks.
Detects writing to /proc/self/mem for in-memory code injection on Linux
This rule detects network connection events where the AutoGen Studio application (identified by its image filename) initiates connections to localhost (127.0.0.1 or ::1) on ports 8080 or 8081. This is typical behavior for the AutoGen Studio web interface or API server running locally.
Detects clearing of network connection history to remove forensic evidence
Detects enumeration of running processes for target reconnaissance
Detects the spawning of suspicious command-line interfaces or utility processes (e.g., cmd.exe, powershell.exe, curl.exe) by an AutoGen Studio Python process. This pattern is indicative of potential exploitation attempts where an adversary leverages AutoGen Studio's capabilities to achieve arbitrary code execution on the underlying host.
Detects malicious installer packages with custom actions for persistence
Detects anomalous activity originating from AutoGen Studio AI agents, specifically identifying attempts to abuse loopback trust boundaries via MCP (Model Context Protocol) WebSocket requests to localhost (ports 8080/8081) or the execution of suspicious child processes commonly used for command-line interference, indicative of AI agent compromise or attacker-controlled MCP command injection.
Detects potential Remote Code Execution (RCE) in an AutoGen Studio environment by correlating an unexpected outbound network connection from the AutoGen process to an external endpoint, followed by the immediate spawning of a command interpreter (shell) child process containing common command-line interface indicators (e.g., whoami, curl, wget, encoded PowerShell).
Detects unauthorized inbound WebSocket connections from external (non-private) IP addresses to the AutoGen Studio MCP API endpoint at /api/mcp/ws/ on port 8081, followed by the execution of interpreter processes (autogenstudio, uvicorn, or python) on the same host, indicating a potential exploitation of an origin validation bypass for remote code execution.
Detects theft of browser session cookies for account takeover
Detects spinning up of virtual machines to conduct malicious activity in isolation
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
Detects reconnaissance activities aimed at identifying c-ares library linkage using tools like ldd, readelf, and strings, or via pattern matching in files. It also monitors for the suspicious loading of cares.dll outside of expected vendor directories and the execution of specific files identified as part of a c-ares TCP use-after-free proof-of-concept.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
Page 216 of 341