Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects outbound network traffic associated with Djinn Stealer malware beaconing to a hardcoded C2 IP address (96.126.130.126) on port 58942. The detection specifically monitors for HTTP POST requests containing the malicious User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content-type, which are characteristic of this stealer's exfiltration activity.
Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '..') in the destination argument. This behavior is indicative of an attempt to escape the container environment and write files to the host filesystem, potentially exploiting the 'docker-cp-copyout' vulnerability.
Detects the installation of a malicious Chrome extension (identified by its extension ID) that abuses declarativeNetRequest permissions to intercept and redirect user search queries through the 'perplexity-ai.online' domain. The detection correlates the creation of the extension's directory on disk with a high volume of network connections from the browser to the malicious intermediary domain.
This rule detects potential command-and-control (C2) activity or data exfiltration by monitoring for first-time DNS resolution of known typosquatted domains targeting 'Perplexity AI', followed by persistent outbound network connections from common web browsers to the same domain family.
Detects a malicious browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as Perplexity AI. The rule identifies the extension installation followed by a two-hop network redirect sequence: the browser is first directed to a malicious domain (perplexity-ai.online) which logs user metadata, then immediately redirected to a ZIP file download lure on a different domain. This behavior is correlated within a 30-minute window for a specific browser process.
Detects the Djinn Stealer malware accessing sensitive configuration files and credential stores related to AI coding assistants (e.g., Claude, Codex, Gemini, Cline) and common development utilities (e.g., AWS, GKE, SSH) on Linux workstations. It also detects the creation of a 'linux-process-env.json' file, which is an artifact used by the stealer to exfiltrate environment variables harvested from process memory.
Detects anomalous child process creation from PHP-FPM or PHP web worker processes. This is indicative of exploitation activity, specifically targeting vulnerabilities in PHP environments where deserialization or memory access (e.g., ASLR bypass via /proc/self/maps) leads to unauthorized code execution and subsequent command-line tool usage.
Detects Node.js processes executing with suspicious command-line arguments that include specific file extensions (.woff, .woff2, .svg, .jpeg, .png, .dict) or known suspicious file names associated with potential malicious activity or obfuscation.
Detects instances where Node.js or Code.exe (e.g., VS Code integrated terminals) spawns child processes executing suspicious JavaScript files or command-line arguments indicative of web-based exploitation or lateral movement, such as 'jsonwebauth', 'lserver.js', or 'errorHandler.js'.
Detects Visual Studio Code or similar IDE processes launching command-line interpreters (e.g., cmd, powershell, node, python) with suspicious command-line arguments indicative of file downloads, script execution, or network reconnaissance. This rule is designed to identify potential malicious extensions or compromised development environments.
Detects behavior indicative of the InvisibleFerret information stealer, specifically focusing on Python execution spawned by development tools (VS Code/Node.js), unauthorized access to browser-based credential stores or local crypto wallets, and suspicious outbound network activity originating from Python processes spawned by development/automation tools.
This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.
This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.
This rule detects potentially malicious clipboard data access by scripting engines (Python, Node.js) and command-line utilities (xclip, xdotool, PowerShell). It monitors for specific API calls, module imports, or command arguments that signify reading or interacting with the system clipboard, often used by malware for credential theft or data exfiltration.
Detects instances where common scripting engines such as node.exe, python.exe, or related variants access known web browser credential storage files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealing malware, notably identified in the BeaverTail and InvisibleFerret malware families used during the 'Contagious Interview' campaign to exfiltrate sensitive browser data.
This rule detects unauthorized or unexpected processes accessing sensitive local files containing cloud provider credentials, configuration, or environment variables. It identifies access to files such as .aws/credentials, .azure/accessTokens.json, .npmrc, and .env by processes that are not recognized cloud CLI tools. The rule prioritizes alerts involving developer-oriented applications like VS Code or Node.js, which may indicate credential theft or compromise of a developer's workstation environment.
Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.
Detects high-volume SSH or network logon failures from a single source IP address within a short time window, indicative of a brute force attack. The rule specifically mentions consistency with 'mpbrute2.bin' tooling used in the 'FortiBleed' campaign.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Page 231 of 340