Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects indicators of exploitation attempts for the libssh2 pre-auth heap RCE vulnerability (CVE-2026-55200). The rule monitors for the execution of known harness binaries, abnormal child processes spawned by sshd, unauthorized file creation in sensitive temporary directories, and the loading of libssh2 libraries from non-standard, writable locations.
Identifies unauthorized attempts to leverage ssh-add or access the SSH agent socket to dump or forward local developer identities.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects unauthorized execution of node.exe by the Flowise process, where a case-insensitive environment variable (node_options) is used to bypass Flowise's security block list. This enables attackers to leverage the --require flag to preload malicious JavaScript code. The detection also monitors for the presence of a 'flowise_marker.txt' file as a secondary indicator.
This rule detects outbound network connections to the typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious Chromium extension masquerading as a 'Search for Perplexity AI' tool, which uses this domain for search-traffic interception and command-and-control (C2) exfiltration.
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
This rule detects potential exploitation of the PHP StreamBucket SOAP RCE vulnerability (CVE-2026-55199). It monitors for characteristic post-exploitation behaviors, including the spawning of unexpected shell or system utility processes, access to sensitive memory mapping files (/proc/self/maps or /proc/self/mem) for ASLR defeat, creation of specific RCE marker files (e.g., /tmp/php857_rce_*.txt), and anomalous outbound network connections following SOAP request activity.
This rule identifies suspicious command-line activity indicative of log manipulation, truncation, or deletion on Cisco SD-WAN controllers. It monitors for the execution of utilities like 'rm', 'shred', 'truncate', 'bash', 'cat', and 'echo' targeting critical system logs, including '/var/log/auth.log' and various 'vdebug' log files. By detecting these anti-forensic techniques, the rule flags potential attempts by adversaries to conceal post-exploitation activity or clear audit trails.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects Server-Side Template Injection (SSTI) and subsequent Remote Code Execution (RCE) attempts within the Floci API Gateway environment. The rule monitors for suspicious child processes spawned by the Floci JVM (e.g., shell execution), the creation of specific RCE proof-of-concept marker files, and the execution of associated exploitation tooling or IAM-bypass command arguments.
Detects indicators of active exploitation or malicious activity targeting the Flowise application. The rule triggers on the creation of a 'flowise_marker.txt' file, the spawning of node processes with suspicious command-line flags ('--require', 'node_options') potentially intended to bypass security controls, and the execution of unexpected shell or scripting processes (cmd, bash, python, etc.) by a Flowise process.
Detects execution of MyBB exploitation scripts, specifically targeting the 'mybb_limited_acp_to_admin' PoC, or evidence of a web server process (PHP) spawning suspicious shell or interpreter child processes, suggesting post-exploitation activity on a MyBB platform.
This rule monitors for the execution of known exploit scripts targeting MyBB forum software. It specifically detects the use of 'mybb_limited_acp_to_admin.py', as well as Python and PHP processes executing command lines that contain indicators of MyBB administrative control panel (ACP) exploitation, such as unauthorized user creation with administrator privileges (gid=4).
Detects execution of specific scripts or suspicious child processes indicative of a MyBB 'limited_acp_to_admin' exploit attempt. This rule looks for known script names related to the PoC and suspicious process lineage where a PHP web server process spawns command shells or scripting interpreters commonly used in post-exploitation activities.
This rule detects the execution of known exploit binaries and proof-of-concept (PoC) tools associated with vulnerabilities in libssh2, as well as anomalous child process spawning from common SSH-related applications (curl, git, php). These behaviors are indicative of exploitation attempts or unauthorized activity related to the libssh2 exploit chain.
Detects signs of active exploitation of the PHP857 vulnerability. The rule identifies suspicious behaviors associated with this RCE, including the spawning of shells by PHP processes, access to sensitive memory maps (/proc/self/) for ASLR bypass, and the creation of specific indicator files or execution of proof-of-concept strings.
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
Page 218 of 347