Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
Detects files or directories created beneath the PSEMHUB environment metadata transactions staging path, which could indicate data staging or server compromise. This rule specifically looks for file creation, modification, or renaming events within paths containing 'PSEMHUB.war' and '/envmetadata/transactions/' or '\envmetadata\transactions\'.
Detects modification of scripts in extension folders.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects the creation of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508.
Detects vLLM processes spawning common reverse shell binaries, indicating potential exploitation of CVE-2026-22778.
Detects vLLM performing unauthorized system reconnaissance by executing common system information discovery commands such as 'whoami', 'id', 'uname', 'hostname', 'ifconfig', and 'ip'. This activity is indicative of an attacker attempting to gather information about the compromised system.
This rule detects instances where 'autogenstudio' is the initiating process for spawning common Unix shells (bash, sh, dash, wsl.exe). This activity is indicative of the AutoJack Remote Code Execution (RCE) vulnerability.
Identifies the Python backdoor natively invoking sudo -k -S pwd to silently validate phished credentials against the OS.
Identifies process execution patterns matching the open-source nord-stream tool, abused by the actor to steal GitHub Actions secrets.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Identifies a backdoored model's payload executing post-deserialization to read developer secrets (SSH keys, AWS credentials, NPM tokens) and exfiltrate them.
This rule detects a classic malicious model attack chain where a Python process reads a .pkl, .pt, or .bin model file, and immediately spawns an anomalous system shell or execution utility. This indicates potential Remote Code Execution (RCE) via deserialization vulnerabilities in machine learning models.
Detects browser processes invoking internal extension schemes and subsequently generating high volumes of network requests to e-commerce or advertising-related domains/URLs, indicating potentially malicious browser extension behavior such as affiliate tag substitution or ad-injection.
This rule monitors DNS query events to detect internal systems attempting to resolve the domain 'bluegraintours.com', which is indicative of potential command and control (C2) communication or malware activity.
Detects MYRA RAT's proc_hide and agent_launcher components masquerading as systemd-userdbd by copying Node.js binary to /usr/lib/systemd/systemd-userdbd and using prctl PR_SET_NAME to overwrite process name and argv[0]. This rule identifies suspicious process activity where a process attempts to impersonate 'systemd-userdbd' by having a matching folder path or command line, but originating from an unexpected location or being associated with known MYRA RAT components like 'agent_launcher' or 'proc_hide', or Node.js.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Page 240 of 347