Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Fraud framework powering scam domains for crypto and gambling schemes
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Detects commands exporting all environment variables (env, set, printenv) to a file, often used to steal CI/CD secrets on developer workstations. The rule specifically looks for these commands being executed by common scripting/execution environments like node.exe, python.exe, bash, or cmd.exe.
Detects unusual internal SSH connections between private IP addresses that are not initiated by common, trusted administrative tools (like ssh.exe, putty.exe, etc.). The rule aggregates these connections by source and host to identify potential lateral movement.
Detects pip installing the benign-looking termncolor package together with colorinal. This dependency relationship was used to conceal delivery of platform-specific ZiChatBot droppers, as observed in campaigns attributed to OceanLotus (APT32). The rule specifically looks for command-line executions of pip or python with 'pip install' and the presence of 'termncolor', 'colorinal', or 'uuid32-utils' in the command line.
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
This rule monitors for the creation or modification of files containing the string 'readme_locker' in their filename. This pattern is commonly associated with ransomware strains that leave behind ransom notes, often as part of the data encryption impact phase.
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Detects suspicious credential harvesting activities, specifically identifying processes performing a sweep of multiple sensitive configuration files (e.g., AWS, Kubernetes, SSH keys, npm, git) or processes accessing /proc/self/environ to enumerate environment variables for sensitive data.
Detects potential supply-chain attacks where a malicious 'preinstall' hook in an npm package drops and executes a native binary (ELF or PE) from within the 'node_modules' directory. It monitors both the initial execution of the binary by npm/node and subsequent network activity from such binaries, specifically targeting suspicious subdirectories like 'tools/' or '.bin/'.
Clipboard hijacking malware for cryptocurrency address substitution
Clipboard hijacking malware for cryptocurrency address substitution
This rule detects potentially malicious npm activity, including the execution of preinstall hooks in non-standard locations, the use of publishing commands with external registry flags, and the execution of suspicious scripts located within node_modules directories, often indicative of a software supply chain compromise.
Clipboard hijacking malware for cryptocurrency address substitution
Detects the execution of setup or precheck scripts from specific paths ('/tools/setup' or '/.github/scripts/precheck') when spawned by common development-related shell or Node.js processes. This pattern often identifies anomalous build-time activities or execution of unauthorized configuration scripts in CI/CD or development environments.
This rule detects potentially suspicious process execution behavior on Linux systems. It triggers on the execution of specific files often used as build tools or pre-check scripts ('/tools/setup', '/.github/scripts/precheck') or processes spawned from 'node_modules' directories by common Node.js package managers ('npm', 'node', 'npx') where the spawned executable lacks standard script file extensions (e.g., .js, .sh). This is indicative of potential execution of arbitrary binaries or obfuscated scripts within a development or CI/CD environment.
Page 229 of 347