Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508.
Detects the execution or presence of a script named 'proxyshell_01.sh' in process command lines. This script has been associated with MuddyWater activity, specifically in the context of exploiting ProxyShell vulnerabilities.
Correlates the execution of a script from a cloned repository accessing developer credential stores (SSH keys, AWS profiles) within a tight time window. This rule specifically looks for file access events on common credential files (id_rsa, credentials, config) within sensitive directories (.ssh, .aws, .kube) that are initiated by a process whose command line contains keywords often associated with development activities or social engineering lures (interview, test, assignment).
Detects instances where AutoGenStudio or MultimodalWebSurfer processes spawn potentially malicious or living-off-the-land (LOLBin) child processes. This behavior may indicate an exploit chain where a web-based RCE leads to arbitrary command execution on the host system.
Detects network activity and DNS lookups associated with the domain 'loopedin.io', which has been identified as a second-hop open-redirect service used in forged healthcare-themed phishing campaigns. The rule specifically monitors connections from common web browsers to facilitate the identification of redirected user traffic.
Detects a potential OS command injection attack targeting AutoGen Studio. The rule correlates a suspicious WebSocket connection to the Model Context Protocol (MCP) endpoint on localhost:8081, specifically containing the 'server_params' parameter, with a subsequent shell process spawning from an AutoGen Studio, Python, or Uvicorn parent process. The shell command line includes common injection characters (e.g., ;, |, &&, ||) and OS enumeration commands (e.g., whoami, id, net user).
Detects a potential Remote Code Execution (RCE) chain originating from AI orchestration frameworks (such as AutoGen/Uvicorn). The rule identifies an execution flow where an AI framework launches a browser automation process (e.g., Playwright/Chromium), which subsequently spawns a suspicious OS shell or LOLBin (Living-off-the-Land Binary) that immediately initiates an external network connection. This behavior is indicative of an AI agent being coerced to bypass security controls via MCP (Model Context Protocol) WebSocket loopback trust, leading to command execution and external C2 communication.
This rule monitors network traffic for outbound connections to a specific remote IP address (38.60.253.35) on port 8084. This pattern is indicative of communication with a known command-and-control server or malicious infrastructure.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Detects anomalous behavior associated with the PHP 8.5.7 SOAP remote code execution (RCE) vulnerability. The detection monitors for PHP/PHP-FPM processes spawning suspicious child processes (e.g., shell, python, powershell), the creation of specific exploitation marker files (e.g., php857_rce, rpoc.php), and suspicious command-line patterns indicative of payload execution or command-based exploitation techniques.
Correlates the creation and immediate deletion of the 'trin.tar.gz' archive, which is handled by the Python temporary-directory context manager, indicating potential malicious activity associated with TeamPCP.
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
Detects instances where a process command line includes both 'base64' and '.env', indicating potential encoding of sensitive .env files. Attackers often encode these files before exfiltration to bypass basic Data Loss Prevention (DLP) string matching and obscure the data.
Detects evidence of exploitation targeting a use-after-free vulnerability in the c-ares DNS library. The rule monitors for three primary indicators: abnormal child process creation (e.g., cmd.exe or calc.exe) originating from applications known to link against c-ares (like node.exe or curl.exe), the presence of specific proof-of-concept (PoC) artifact files on disk, and the direct execution of identified c-ares exploitation harness binaries or scripts.
Detects anomalous child process creation from FFmpeg-related binaries (ffmpeg, ffplay, ffprobe) indicative of arbitrary code execution stemming from memory corruption vulnerabilities in the RASC/DLTA codec handler.
Detects attempts to perform a container escape via the docker cp command by abusing path traversal vulnerabilities or suspicious file write operations performed by the Docker daemon to the host filesystem outside of standard container paths, often associated with symbolic link extraction exploits.
Detects anomalous child process execution from PHP worker processes (php-fpm, php-cgi, php.exe) that may indicate exploitation of a PHP 8.5.7 stream bucket Use-After-Free (UAF) vulnerability. Attackers can leverage crafted SOAP requests to achieve remote code execution, resulting in the PHP worker spawning command shells (e.g., sh, bash, cmd.exe) or other interpreters (e.g., python, curl) to execute malicious payloads.
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers. MITRE ATT&CK: T1046, T1082 References: - https://www.bleepingcomputer.com/news/security/oracle-peoplesoft-servers-hacked-in-shinyhunters-data-theft-attacks/
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects Python or a shell replacing the installed Chrome build with an older package before installing a wallet extension that requires Manifest V2 capabilities. This activity is associated with the InvisibleFerret malware.
Detects unauthorized execution of SAP RFC exploitation scripts that leverage SXPG_CALL_SYSTEM or SXPG_COMMAND_INSERT to inject and execute OS commands. This behavior is associated with exploitation tactics targeting SAP environments, specifically identified by the presence of custom ZREDTEAM artifacts and known malicious script naming conventions.
Page 239 of 340