Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects execution of MyBB exploitation scripts, specifically targeting the 'mybb_limited_acp_to_admin' PoC, or evidence of a web server process (PHP) spawning suspicious shell or interpreter child processes, suggesting post-exploitation activity on a MyBB platform.
This rule monitors for the execution of known exploit scripts targeting MyBB forum software. It specifically detects the use of 'mybb_limited_acp_to_admin.py', as well as Python and PHP processes executing command lines that contain indicators of MyBB administrative control panel (ACP) exploitation, such as unauthorized user creation with administrator privileges (gid=4).
Detects execution of specific scripts or suspicious child processes indicative of a MyBB 'limited_acp_to_admin' exploit attempt. This rule looks for known script names related to the PoC and suspicious process lineage where a PHP web server process spawns command shells or scripting interpreters commonly used in post-exploitation activities.
This rule detects the execution of known exploit binaries and proof-of-concept (PoC) tools associated with vulnerabilities in libssh2, as well as anomalous child process spawning from common SSH-related applications (curl, git, php). These behaviors are indicative of exploitation attempts or unauthorized activity related to the libssh2 exploit chain.
Detects signs of active exploitation of the PHP857 vulnerability. The rule identifies suspicious behaviors associated with this RCE, including the spawning of shells by PHP processes, access to sensitive memory maps (/proc/self/) for ASLR bypass, and the creation of specific indicator files or execution of proof-of-concept strings.
Detects the Gitea Act Runner CI/CD tool executing Docker containers with dangerous security flags (such as --privileged, --pid=host, or --cap-add=ALL) or spawning nsenter to interact with host namespaces. This behavior indicates a potential attempt to escape the container boundary and gain unauthorized root-level access on the underlying CI/CD runner host.
Detects evidence of post-exploitation anti-forensic activity on Cisco SD-WAN components (vManage, vSmart, vBond). This rule monitors for unauthorized removal of logs and exploitation artifacts, the clearing of shell command history, and suspicious modification of file and directory permissions on critical system paths.
This rule detects a scenario where an AI agent (Python or Node.js based) reads a corporate document (PDF, DOCX, TXT, MD) and subsequently spawns a command shell (cmd.exe, powershell.exe, sh, bash) within a 30-second window. This behavior indicates a potential indirect Remote Code Execution (RCE) where a prompt-injected payload from a poisoned document was executed by the AI agent.
Detects bash or sh executing a fanout script from a temporary directory. This behavior is often associated with lateral movement or propagation activities by adversaries.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Detects the execution of commands that parse the /etc/hosts file for PeopleSoft-related node names (WEB, APP, csprd). This activity is indicative of an adversary attempting to discover internal application and web servers, potentially for lateral movement. Threat actors like ShinyHunters have used this technique.
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Detects network traffic over port 6757, which is indicative of PureHVNC command and control (C2) communication.
This rule detects the creation, execution, or presence of specific file names and command-line arguments associated with local RCE research, proof-of-concept exploits, and server-side harnesses, specifically identifying artifacts prefixed with 'libpwn_'.
This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.
Detects the creation or execution of files associated with the Floci remote code execution (RCE) proof-of-concept tool. It monitors for specific filenames or command-line patterns indicative of this exploit, particularly when spawned from Java-based applications or involving shell command execution.
Detects instances where the Ghidra reverse engineering tool (via java.exe or javaw.exe) spawns suspicious child processes. This behavior is considered anomalous as Ghidra typically does not require launching command shells, scripting interpreters, or other system binaries directly from its process tree. Such activity often indicates that an attacker is using the Ghidra environment to execute secondary payloads or perform post-exploitation tasks.
Detects potential exploitation attempts against Flowise by monitoring for suspicious child process creation. The rule flags Node.js processes spawned by Flowise that utilize case-insensitive command-line bypass patterns or reference suspicious environment variables, which may indicate an attempt to override security configurations through environment variable manipulation (e.g., node_options).
Detects indicators of exploitation attempts targeting the c-ares asynchronous DNS library, specifically focusing on Use-After-Free (UAF) vulnerabilities. The rule monitors for the presence of known proof-of-concept (PoC) file artifacts, execution of processes using specific command-line flags associated with c-ares exploit research, suspicious shell/calculator spawning from common network-enabled applications (curl, node, python), and anomalous high-frequency DNS-over-TCP traffic patterns.
Page 234 of 340