Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.
Detects bash or sh executing install.sh from an OpenClaw skill directory, matching the alternate macOS and Linux GhostLoader bootstrap path. This activity is associated with the malicious OpenClaw skill distributing Remcos RAT and GhostLoader.
Detects the 'node' process creating hidden JavaScript or native loader files (e.g., .js, .node, .so, .dylib, .bin) in user profile or temporary directories. This activity is indicative of the OpenClaw malware's staging phase, where it drops its components for persistence or further execution.
Detects attempts to access SSH private keys (id_rsa, id_ed25519) or public keys (.pub files) by 'node' or 'python' processes. This activity could indicate an attacker attempting to collect SSH credentials for lateral movement or persistence.
Detects modification of scripts in extension folders.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects vLLM processes spawning common reverse shell binaries, indicating potential exploitation of CVE-2026-22778.
Detects vLLM performing unauthorized system reconnaissance by executing common system information discovery commands such as 'whoami', 'id', 'uname', 'hostname', 'ifconfig', and 'ip'. This activity is indicative of an attacker attempting to gather information about the compromised system.
This rule detects instances where 'autogenstudio' is the initiating process for spawning common Unix shells (bash, sh, dash, wsl.exe). This activity is indicative of the AutoJack Remote Code Execution (RCE) vulnerability.
Identifies the Python backdoor natively invoking sudo -k -S pwd to silently validate phished credentials against the OS.
Identifies process execution patterns matching the open-source nord-stream tool, abused by the actor to steal GitHub Actions secrets.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Identifies a backdoored model's payload executing post-deserialization to read developer secrets (SSH keys, AWS credentials, NPM tokens) and exfiltrate them.
Detects a network beacon triggered strictly during model initialization. If a Python process loads a model file and immediately establishes an outbound TCP connection to an unknown IP, it indicates an embedded payload phoning home.
Detects browser processes invoking internal extension schemes and subsequently generating high volumes of network requests to e-commerce or advertising-related domains/URLs, indicating potentially malicious browser extension behavior such as affiliate tag substitution or ad-injection.
This rule monitors DNS query events to detect internal systems attempting to resolve the domain 'bluegraintours.com', which is indicative of potential command and control (C2) communication or malware activity.
Detects MYRA RAT's proc_hide and agent_launcher components masquerading as systemd-userdbd by copying Node.js binary to /usr/lib/systemd/systemd-userdbd and using prctl PR_SET_NAME to overwrite process name and argv[0]. This rule identifies suspicious process activity where a process attempts to impersonate 'systemd-userdbd' by having a matching folder path or command line, but originating from an unexpected location or being associated with known MYRA RAT components like 'agent_launcher' or 'proc_hide', or Node.js.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Page 232 of 340