Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the unauthorized injection of the 'GEMINI_TRUST_WORKSPACE=true' environment variable via process command lines or shell environments. This rule identifies potential exploitation attempts related to CVE-2026-12537 by flagging instances where this variable is set outside of defined, trusted CI/CD runner environments.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Detects instances where common shell or command-line tools are spawned by Amazon Q processes (amazonq-language-server) or development-related processes (Code.exe, node) shortly after the creation or access of the 'mcp.json' configuration file within an '.amazonq' directory. This behavior may indicate an attacker using development tool vulnerabilities or compromised extensions to execute arbitrary commands.
Detects common patterns of post-exploitation activity including downloading scripts (isp.sh) via curl/wget, executing shell commands to fetch remote payloads, running suspicious binaries from temporary directories like /var/tmp or /tmp, and persistent execution patterns.
Detects execution patterns associated with the DirtyClone local privilege escalation exploit. The rule monitors for the execution of the exploit binary, compilation of related exploit source code, the creation of combined user and network namespaces via unshare, manipulation of IPsec xfrm states/policies by unprivileged users, and the spawning of a root shell via su. These activities are indicative of an attempt to elevate privileges from an unprivileged context to root.
Detects the execution of known network scanning utilities (nmap, masscan, portscan) or suspicious command line arguments often associated with network reconnaissance activities.
This rule detects potentially malicious activities on Linux systems, including the download of files via curl or wget from a specific IP address, execution of scripts named 'isp.sh', usage of hidden temporary files (e.g., .xlamb), detection of processes named 'lambsys', and execution of scripts within the /var/tmp directory after a chmod +x command. These patterns are often associated with stage-1 or stage-2 dropper behaviors, malware persistence, or post-exploitation activities.
Detects suspicious command-line execution patterns involving common SSH files and utilities, such as access to SSH keys, known_hosts, authorized_keys, or suspicious configuration flags. This pattern often indicates attempts to harvest SSH credentials, bypass host key checking, or facilitate persistent remote access. The rule specifically looks for these actions when performed by standard shell utilities or automated tools.
Detects the execution of known network scanning utilities (nmap, masscan, portscan) or suspicious command line arguments often associated with network reconnaissance activities.
This rule detects suspicious activity on Linux endpoints related to the execution of files named 'isp.sh' or 'lambsys', as well as potential file downloads from a known malicious IP address. It monitors process creations and file creations involving these specific artifacts, as well as common attack patterns such as piping web-downloaded content directly to a shell.
Detects attempts to disable or flush system firewall rules on Linux platforms using common utilities like iptables, ufw, or nftables. Adversaries perform these actions to bypass network access controls and facilitate malicious activities such as command and control communications or lateral movement.
Identifies post-exploitation reverse shells resulting from the LiteLLM RCE vulnerabilities. This rule specifically looks for process creation events where the parent process is associated with LiteLLM (either the 'litellm' executable or a Python process running 'litellm') and the spawned child process command line contains common reverse shell patterns such as 'bash -i', '/dev/tcp/', 'nc -e', or 'sh -i'.
Detects files or directories created beneath the PSEMHUB environment metadata transactions staging path, which could indicate data staging or server compromise. This rule specifically looks for file creation, modification, or renaming events within paths containing 'PSEMHUB.war' and '/envmetadata/transactions/' or '\envmetadata\transactions\'.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.
Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.
Detects anomalous authentication patterns where a single source IP address exhibits multiple failed login attempts followed by at least one successful login within a 10-minute time window, indicative of credential stuffing or password spraying.
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
Page 236 of 340