Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects network requests to the BadBlocker (AdBlock for YouTube) infrastructure that fetch malicious scriptlet rules. These rules are designed to leverage Chrome's scripting API to execute arbitrary JavaScript in the 'MAIN' world of web pages, effectively bypassing Content Security Policy (CSP) protections to inject unauthorized content.
Detects exploitation of CVE-2026-25157 where the OpenClaw AI agent is manipulated to execute arbitrary commands via a malicious SSH target string. The vulnerability allows an attacker to inject command-line options like '-oProxyCommand' into the SSH client, leading to local command execution.
Detects the execution of the Squid proxy application with command line arguments that may indicate its use for malicious proxying or tunneling activities. This includes arguments related to safe ports, connection types (CONNECT, PORT, PASV), specific port numbers (21), and outgoing address configurations.
Detects the execution of processes with command line arguments containing terms related to quantum-resistant or post-quantum cryptography (e.g., lattice, isogeny, multivariate, hash). This is intended to identify the usage of specific cryptographic libraries or tools that may be relevant for advanced adversaries researching post-quantum decryption techniques or securing their own communications against future quantum-enabled decryption.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the Check Point research.
Detects potentially unauthorized or suspicious child process execution originating from IDEs associated with Amazon Q/CodeWhisperer. The rule monitors for common shell execution (bash, sh, node) or AWS-related command-line activity that may indicate credential harvesting or exfiltration via IDE extensions.
This rule detects the creation of a 'mcp.json' configuration file within an '.amazonq' directory shortly after version control system operations such as 'git clone', 'git pull', 'npm install', or 'pip install'. This activity may indicate an attempt to configure or persist unauthorized developer tools or malicious assistant configurations within a development environment.
Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.
Detects modifications or creations of manifest.json files within specific directories associated with a browser extension. This behavior is often indicative of the installation or tampering of browser extensions by malicious actors to establish persistence, perform credential theft, or execute unauthorized actions within the browser context.
This rule detects potential unauthorized access to AWS credentials by monitoring process creation events involving the 'get-caller-identity' command. It identifies scenarios where AWS access key environment variables are accessed or manipulated, and monitors common shell or node processes executing commands to query AWS identity information, which may indicate credential exfiltration or reconnaissance by an attacker.
Detects the execution of AWS STS 'get-caller-identity' commands via a network utility (curl) initiated by common development tools like VS Code, node, or amazonq-lsp. This behavior is indicative of potential cloud credential theft or reconnaissance performed through a compromised developer environment.
Detects network communication associated with BeepRAT, specifically identifying direct TCP connections to a known command-and-control IP address on a non-standard port or DNS requests directed at a specific malicious domain.
This rule detects the creation of a specific file named 'linux-process-env.json' on Linux endpoints. The creation of environment-related configuration files in unexpected locations or by unauthorized processes may indicate reconnaissance, staging of malicious configuration, or post-exploitation activities by an adversary.
Detects unauthorized processes reading, creating, or modifying sensitive files associated with local AI development tools and assistants (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). This rule monitors for file operations outside of the known, legitimate AI tool processes, suggesting potential credential theft or configuration tampering by malicious software.
Detects anomalous network activity originating from Firefox (firefox.exe). The rule flags connections to port 8765 (associated with specific browser-based exfiltration PoCs) and any outbound connection on non-standard ports (excluding common browser ports: 80, 443, 8080, 8443, 8888, 53) directed to public IP addresses.
Detects instances where image processing utilities (ImageMagick's magick.exe or convert.exe) launch Ghostscript binaries (gs, gswin64c.exe) from non-standard directories (such as temp, user profile, or appdata folders) or utilize suspicious command-line arguments that attempt to bypass security policies. This activity is often associated with exploitation of image processing vulnerabilities where attacker-supplied files trigger arbitrary command execution.
Detects the execution of Node.js processes initiated by or related to the Flowise low-code AI platform, specifically where the --require flag is used. This pattern may indicate the loading of arbitrary JavaScript code or modules into the Node.js runtime, which could be indicative of malicious code injection or exploit activity within the Flowise environment.
Detects potential privilege escalation attempts against a MyBB forum by monitoring POST requests to administrative endpoints. Specifically, it flags session activity that includes creating new users with admin group assignments (usergroup=4) or accessing sensitive administrative modules (config, tools, style, user) from within the admin control panel.
Detects unauthorized mass access to AI development tool configuration files and credentials. The rule identifies processes reading sensitive files associated with tools such as Claude (mcp.json, projects), Codex (config.toml, sessions), Gemini (settings.json, .env), Cline, OpenCode, and Kilo.
Page 230 of 340