Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
A node/python/pip-driven package install resolves a domain that Palo Alto classifies as newly-registered within seconds of the install. This signals a potential malicious dependency or compromised package beaconing to attacker infrastructure (supply-chain compromise / install-time C2).
Detects the 'node' process creating hidden JavaScript or native loader files (e.g., .js, .node, .so, .dylib, .bin) in user profile or temporary directories. This activity is indicative of the OpenClaw malware's staging phase, where it drops its components for persistence or further execution.
Detects the installation of specific Chrome browser extensions associated with the 'BadBlocker' campaign. These extensions are known to request broad host permissions, allowing them to access data across all websites, which can lead to sensitive information theft, credential harvesting, or session hijacking.
This rule monitors and alerts on network connections originating from hosts to known command-and-control (C2) or infrastructure domains associated with malicious browser extensions, specifically those identified in the BadBlocker campaign. These extensions often masquerade as legitimate ad-blocking tools to perform lifecycle beaconing or redirect users to promotional/malicious content.
Detects outbound HTTP/HTTPS requests to api.adblock-for-youtube.com to fetch scriptlet rules. This activity is consistent with the Adblock for YouTube extension (cmedhionkhpnakcndndgjjdbohmhepckk) periodically polling for updates.
Detects network, process, or command-line activity associated with the installation or update of malicious Chrome extensions linked to the BadBlocker campaign. The rule specifically monitors for known extension IDs: cmedhionkhpnakcndndgjdbohmhepckk (Adblock for YouTube), onomjaelhagjjojbkcafidnepbfkpnee (Adblock for Chrome), gekoepiplklhniacchbbgbhilidiojmb (AdBlock Suite), and ogcaehilgakehloljjmajoempaflmdci (Adblock for You).
Detects attempts to access SSH private keys (id_rsa, id_ed25519) or public keys (.pub files) by 'node' or 'python' processes. This activity could indicate an attacker attempting to collect SSH credentials for lateral movement or persistence.
Detects anomalous, high-frequency bidirectional WebSocket connections (wss/ws) originating from an endpoint that match patterns associated with Bluekit BitM. These connections typically carry DOM serialization events (rrweb-style) and session handshake data, indicative of a victim's keystrokes and mouse movements being relayed to an attacker-controlled browser session.
Detects the use of the 'chmod' command to modify file permissions on critical system directories or files such as /etc/passwd, /etc/shadow, and various log directories. This activity is often indicative of an adversary attempting to facilitate privilege escalation, maintain persistence, or hide malicious artifacts.
This rule detects suspicious update requests to the Ghost CMS Admin API that indicate an attempt at dynamic script injection. It specifically looks for PUT requests to `/ghost/api/admin/posts/` containing markers associated with Base64 decoding (`atob(`) and dynamic DOM manipulation (`appendChild`, `createElement`), or specific strings (`ghost_once_footer_`, `btoa(a.origin)`) known to be used in the Ghost ClickFix attack chain. This activity suggests an attacker is attempting to inject malicious JavaScript into Ghost CMS content, potentially leveraging a vulnerability like CVE-2026-26980.
This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.
This rule detects modifications to SSH authorized_keys files on Linux-based SD-WAN controllers, or successful SSH public key authentication events involving the vmanage-admin user, including attempts to identify authentication from unexpected source IP addresses.
This rule detects potentially malicious activity associated with the exploitation of Ray framework dashboards. It identifies three distinct indicators: inbound network connections to the Ray dashboard port (8265), the execution of common file download tools (e.g., curl, wget) by Ray worker processes, and outbound connections from Ray processes to known C2 infrastructure.
Detects various methods of establishing persistence on Linux systems by abusing dynamic linker configuration (/etc/ld.so.preload), modifying shell startup profiles (.bashrc, .profile) to include malicious environment variables (LD_PRELOAD/LD_LIBRARY_PATH), or directly launching processes with these hijacked variables pointing to suspicious locations such as /tmp, /dev/shm, or /var/tmp.
This rule detects potentially malicious cron job activity, including modifications to crontab files, execution of cron jobs from world-writable directories (such as /tmp or /dev/shm), and the usage of unusual prime-number timing intervals which are commonly used by attackers to evade standard scheduling patterns.
Detects instances where a GitHub Actions runner requests an OIDC token and subsequently executes an npm publish command within 5 minutes. This behavior is indicative of unauthorized package deployment, potentially exploiting GitHub's OIDC 'trusted publishing' mechanism, as observed in the Miasma worm campaign.
Detects vLLM establishing outbound network connections to fetch external media files (e.g., .mov, .mp4, .jp2) from non-private IP addresses. This activity may indicate exploitation of CVE-2026-22778, allowing for remote code execution by fetching malicious content.
A master aggregation capturing processes generating connections to multiple known malicious ports tied to specific campaigns, indicating potential C2 beaconing activity.
Identifies processes executing Base64 decoded commands where the parent script recently communicated with an AI endpoint, representing prompt-injected or AI-generated payloads.
Detects modifications to .git/hooks/pre-commit files across developer workspaces, which is a primary persistence mechanism ensuring payload re-execution on git commits.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Page 237 of 347