Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects enumeration of running processes for target reconnaissance
Detects the spawning of suspicious command-line interfaces or utility processes (e.g., cmd.exe, powershell.exe, curl.exe) by an AutoGen Studio Python process. This pattern is indicative of potential exploitation attempts where an adversary leverages AutoGen Studio's capabilities to achieve arbitrary code execution on the underlying host.
Detects malicious installer packages with custom actions for persistence
Detects potential Remote Code Execution (RCE) in an AutoGen Studio environment by correlating an unexpected outbound network connection from the AutoGen process to an external endpoint, followed by the immediate spawning of a command interpreter (shell) child process containing common command-line interface indicators (e.g., whoami, curl, wget, encoded PowerShell).
Detects a potential OS command injection attack targeting AutoGen Studio. The rule correlates a suspicious WebSocket connection to the Model Context Protocol (MCP) endpoint on localhost:8081, specifically containing the 'server_params' parameter, with a subsequent shell process spawning from an AutoGen Studio, Python, or Uvicorn parent process. The shell command line includes common injection characters (e.g., ;, |, &&, ||) and OS enumeration commands (e.g., whoami, id, net user).
Detects a potential Remote Code Execution (RCE) chain originating from AI orchestration frameworks (such as AutoGen/Uvicorn). The rule identifies an execution flow where an AI framework launches a browser automation process (e.g., Playwright/Chromium), which subsequently spawns a suspicious OS shell or LOLBin (Living-off-the-Land Binary) that immediately initiates an external network connection. This behavior is indicative of an AI agent being coerced to bypass security controls via MCP (Model Context Protocol) WebSocket loopback trust, leading to command execution and external C2 communication.
Detects theft of browser session cookies for account takeover
Detects spinning up of virtual machines to conduct malicious activity in isolation
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
Detects reconnaissance activities aimed at identifying c-ares library linkage using tools like ldd, readelf, and strings, or via pattern matching in files. It also monitors for the suspicious loading of cares.dll outside of expected vendor directories and the execution of specific files identified as part of a c-ares TCP use-after-free proof-of-concept.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
Detects network flows to RustDesk relay server ports (21115, 21116, 21117) characterized by anomalous connection patterns. The rule identifies hosts exhibiting rapid, repeated connection attempts or connections to multiple distinct relay IP addresses within a short timeframe. This behavior is consistent with the 'rustdesk-session-permission-pocs' technique, which may indicate an attacker attempting to establish a remote session while bypassing the standard permission handshake exchange required by the application.
Detects Node.js processes associated with NodeBB making outbound network connections to suspicious paths (/users/, /activities/, /inbox, /.well-known/webfinger). This activity may indicate exploitation of the NodeBB ActivityPub plugin (attributedTo UID spoofing), where an attacker forces the application to fetch attacker-controlled URIs.
Detects evidence of the NodeBB ActivityPub UID spoofing proof-of-concept (PoC) script (poc.js). The rule identifies the execution of node processes using specific command-line arguments (--target-base, --actor-origin, --spoof-uid, --recipient-uid) associated with the exploit, as well as Node.js processes making outbound network connections to ActivityPub path components (/inbox, /activitypub) over non-standard network ports. This activity is indicative of vulnerability testing or exploitation attempts.
Detects evidence of libssh2 publickey list heap corruption exploitation, including the presence or execution of known proof-of-concept (PoC) binaries, malicious SSH server connection patterns on port 2228, and suspicious child processes (e.g., cmd.exe, calc.exe) spawned by SSH clients or daemons.
Detects execution of objdump with DLX architecture flags, unauthorized child processes spawned by objdump, or the execution of known exploit proof-of-concept (PoC) artifacts associated with the 'objdump-dlx-calc-poc' vulnerability.
Detects anomalous child process execution from PHP worker processes (php-fpm, php-cgi, php.exe) that may indicate exploitation of a PHP 8.5.7 stream bucket Use-After-Free (UAF) vulnerability. Attackers can leverage crafted SOAP requests to achieve remote code execution, resulting in the PHP worker spawning command shells (e.g., sh, bash, cmd.exe) or other interpreters (e.g., python, curl) to execute malicious payloads.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Page 225 of 347