Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects theft of Kerberos ccache files containing valid session credentials
Detects PHP or web server processes launching interpreters with encoded, Base64-decoded, or dynamically evaluated command content. This behavior is often indicative of web shell or backdoor execution. The rule specifically looks for web server processes (e.g., php.exe, w3wp.exe, httpd, nginx) as initiating processes, which then launch command interpreters (e.g., cmd.exe, powershell.exe, bash, python) with command lines containing obfuscation techniques like -EncodedCommand, FromBase64String, base64 -d, eval(), exec(), IEX, or Invoke-Expression.
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
This rule detects suspicious process execution patterns on Linux systems, specifically looking for processes running from anonymous memory mappings (memfd), execution via /proc/self/fd (fexecve pattern), and processes masquerading as 'systemd-userdbd' from unexpected file paths. These techniques are often used by adversaries for evasion and persistence.
Detects the execution of known screen capture utilities or commands on Linux systems. This rule looks for processes named 'ffmpeg' or 'grim' and specific command-line arguments often associated with screen recording, such as 'x11grab', 'MJPEG', 'DISPLAY', 'XAUTHORITY', and 'WAYLAND_DISPLAY'. It also flags if the initiating process is 'node', 'systemd-userdbd', or 'npm', which could indicate suspicious activity.
Detects unexpected shell or suspicious utility execution as a child process of media processing or machine learning pipeline services (e.g., ffmpeg, ffprobe, Jellyfin, Nextcloud, Immich, PhotoPrism, vLLM). This behavior can indicate exploitation of vulnerabilities like CVE-2026-8461 (PixelSmash) or other forms of arbitrary code execution, especially when combined with reverse shell indicators or execution by service accounts.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance. This search leverages the Endpoint and Web CIM data models.
Detects the use of 'curl' to download content that is then directly piped to a shell interpreter (bash, sh, zsh). This technique is often used for fileless execution, where a malicious script is executed without being written to disk, as noted in the context of initial Miasma stages.
Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
Detects the MYRA RAT using the prctl system call to rename its process to 'systemd-userdbd'. This masquerading technique aims to evade detection by blending in with legitimate system processes on Linux endpoints. The rule monitors process execution events for instances of 'systemd-userdbd' that do not originate from authorized system directories.
Detects common anti-forensic staging patterns used by IoT botnets such as TerraBot, r00ts3c, and RondoDox. The rule identifies processes that stage payloads in the /tmp directory, set world-writable execution permissions (chmod 777), and immediately delete artifacts following execution to hinder forensic analysis.
Detects unexpected shell or command interpreter processes spawned as children of the vLLM or Python worker processes. This behavior strongly indicates a successful Remote Code Execution (RCE) payload, such as a system() call, resulting from the CVE-2026-22778 JPEG2000 heap overflow exploit.
Browser extension wallet discovery
Cortex XDR
This rule detects command-line activity that searches for sensitive information within browser extension storage, specifically targeting data related to cryptocurrency wallets, password managers, or authenticator applications. It looks for commands executed by common interpreters like cmd, PowerShell, or Python that include keywords associated with extensions and sensitive data like 'wallet', 'metamask', 'password', 'authenticator', '2fa', or 'crypto'. The rule is designed to provide causality and actor information for investigation.
This rule detects attempts by non-browser processes to access sensitive Chromium-based browser files such as 'Login Data', 'Cookies', 'History', 'Web Data', and 'Local State'. These files often contain credentials, browsing history, and other sensitive user data. The rule specifically filters for file access events where the accessing process's command line does not match known browser executables (chrome.exe, msedge.exe, brave.exe, opera.exe, vivaldi.exe), indicating potential credential theft or data exfiltration by malicious software.
Detects the execution of processes with command line arguments containing terms related to quantum-resistant or post-quantum cryptography (e.g., lattice, isogeny, multivariate, hash). This is intended to identify the usage of specific cryptographic libraries or tools that may be relevant for advanced adversaries researching post-quantum decryption techniques or securing their own communications against future quantum-enabled decryption.
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
Page 241 of 340