Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects instances where image processing utilities (ImageMagick's magick.exe or convert.exe) launch Ghostscript binaries (gs, gswin64c.exe) from non-standard directories (such as temp, user profile, or appdata folders) or utilize suspicious command-line arguments that attempt to bypass security policies. This activity is often associated with exploitation of image processing vulnerabilities where attacker-supplied files trigger arbitrary command execution.
Detects the execution of Node.js processes initiated by or related to the Flowise low-code AI platform, specifically where the --require flag is used. This pattern may indicate the loading of arbitrary JavaScript code or modules into the Node.js runtime, which could be indicative of malicious code injection or exploit activity within the Flowise environment.
Detects unauthorized mass access to AI development tool configuration files and credentials. The rule identifies processes reading sensitive files associated with tools such as Claude (mcp.json, projects), Codex (config.toml, sessions), Gemini (settings.json, .env), Cline, OpenCode, and Kilo.
Detects outbound network traffic associated with Djinn Stealer malware beaconing to a hardcoded C2 IP address (96.126.130.126) on port 58942. The detection specifically monitors for HTTP POST requests containing the malicious User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content-type, which are characteristic of this stealer's exfiltration activity.
Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '..') in the destination argument. This behavior is indicative of an attempt to escape the container environment and write files to the host filesystem, potentially exploiting the 'docker-cp-copyout' vulnerability.
Detects the installation of a malicious Chrome extension (identified by its extension ID) that abuses declarativeNetRequest permissions to intercept and redirect user search queries through the 'perplexity-ai.online' domain. The detection correlates the creation of the extension's directory on disk with a high volume of network connections from the browser to the malicious intermediary domain.
This rule detects potential command-and-control (C2) activity or data exfiltration by monitoring for first-time DNS resolution of known typosquatted domains targeting 'Perplexity AI', followed by persistent outbound network connections from common web browsers to the same domain family.
Detects a malicious browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as Perplexity AI. The rule identifies the extension installation followed by a two-hop network redirect sequence: the browser is first directed to a malicious domain (perplexity-ai.online) which logs user metadata, then immediately redirected to a ZIP file download lure on a different domain. This behavior is correlated within a 30-minute window for a specific browser process.
Detects the Djinn Stealer malware accessing sensitive configuration files and credential stores related to AI coding assistants (e.g., Claude, Codex, Gemini, Cline) and common development utilities (e.g., AWS, GKE, SSH) on Linux workstations. It also detects the creation of a 'linux-process-env.json' file, which is an artifact used by the stealer to exfiltrate environment variables harvested from process memory.
Detects instances where Node.js or Code.exe (e.g., VS Code integrated terminals) spawns child processes executing suspicious JavaScript files or command-line arguments indicative of web-based exploitation or lateral movement, such as 'jsonwebauth', 'lserver.js', or 'errorHandler.js'.
Detects Visual Studio Code or similar IDE processes launching command-line interpreters (e.g., cmd, powershell, node, python) with suspicious command-line arguments indicative of file downloads, script execution, or network reconnaissance. This rule is designed to identify potential malicious extensions or compromised development environments.
Detects behavior indicative of the InvisibleFerret information stealer, specifically focusing on Python execution spawned by development tools (VS Code/Node.js), unauthorized access to browser-based credential stores or local crypto wallets, and suspicious outbound network activity originating from Python processes spawned by development/automation tools.
This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.
This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.
This rule detects potentially malicious clipboard data access by scripting engines (Python, Node.js) and command-line utilities (xclip, xdotool, PowerShell). It monitors for specific API calls, module imports, or command arguments that signify reading or interacting with the system clipboard, often used by malware for credential theft or data exfiltration.
Detects instances where common scripting engines such as node.exe, python.exe, or related variants access known web browser credential storage files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealing malware, notably identified in the BeaverTail and InvisibleFerret malware families used during the 'Contagious Interview' campaign to exfiltrate sensitive browser data.
This rule detects unauthorized or unexpected processes accessing sensitive local files containing cloud provider credentials, configuration, or environment variables. It identifies access to files such as .aws/credentials, .azure/accessTokens.json, .npmrc, and .env by processes that are not recognized cloud CLI tools. The rule prioritizes alerts involving developer-oriented applications like VS Code or Node.js, which may indicate credential theft or compromise of a developer's workstation environment.
Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.
Detects high-volume SSH or network logon failures from a single source IP address within a short time window, indicative of a brute force attack. The rule specifically mentions consistency with 'mpbrute2.bin' tooling used in the 'FortiBleed' campaign.
Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
Page 239 of 347