Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of the XDRAgent process with command-line arguments indicative of a reverse shell connection to a specific remote IP address and port.
This rule detects potentially malicious process behavior on Linux systems. It triggers on two conditions: 1) Masquerading of the 'systemd-userdbd' process by detecting processes named 'systemd-userdbd' that do not originate from the legitimate system path. 2) Fileless execution by detecting process image paths that contain 'memfd:', which is commonly associated with loading malicious binaries directly from anonymous memory to evade disk-based detection.
Detects anomalous execution of the Bun runtime on CI/CD infrastructure, often associated with the 'Miasma/Mini Shai-Hulud' campaign. The rule monitors for unauthorized Bun process creation spawned by Node.js package management tools (likely via binding.gyp lifecycle hooks), execution using specific campaign-related command-line arguments, or network activity initiated by Bun on non-standard paths, which may indicate build-time compromise and subsequent C2 communication.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.
Detects anomalous process execution patterns associated with supply chain compromises (specifically Miasma/Mini Shai-Hulud 'Phantom Gyp'), where node-gyp build processes or npm lifecycle scripts trigger the execution of unexpected scripts or unauthorized runtimes like Bun.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
This rule detects potentially unauthorized or suspicious command execution originating from AI development assistant processes such as Claude, Cursor, Amazon Q, or Node-based environments. It specifically monitors for the invocation of shell commands (e.g., bash, sh -c) or package managers (npx) that interact with sensitive AI assistant configuration files (e.g., .amazonq, mcp.json), which could indicate an adversary attempting to leverage AI integration paths for unauthorized command execution or persistent configuration manipulation.
Detects instances where the 'git clone' command is executed, followed by the creation of a configuration file at '.amazonq/mcp.json'. This pattern may indicate the setup or configuration of Amazon Q developer tools on an endpoint, which could be abused for unauthorized access or information gathering if performed by an unauthorized user or process.
This rule detects potential container escape attempts utilizing Linux system calls such as 'unshare' or 'clone' with flags indicative of namespace manipulation (CLONE_NEWUSER, CLONE_NEWNET). It also detects the execution of suspected malicious binaries or traffic manipulation tools associated with 'packet_edit_meme' or 'act_pedit' activities, which are common in Linux-based exploitation scenarios.
Detects the use of specific Linux utilities often associated with container escape or privilege escalation exploits. This includes the use of 'aa-exec' with restricted profiles, 'unshare' for namespace manipulation, and specific command-line patterns targeting vulnerability-related exploitation scripts.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Detects when development tools such as VS Code, VS Code OSS, or Node.js spawn a shell (bash/sh) to execute network-related commands (aws, curl, wget, npx). This behavior is characteristic of an adversary leveraging a developer's environment to download payloads, interact with cloud resources, or perform reconnaissance.
Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.
Detects the use of 'unshare' to create new kernel namespaces or 'tc' (Traffic Control) with specific parameters (pedit) to manipulate packet headers. These tools are often leveraged by adversaries to perform privilege escalation or network redirection/manipulation within a Linux environment.
Detects execution of Linux Traffic Control (tc) commands, module loading, or specific strings related to the exploitation of CVE-2026-46331, involving the act_pedit kernel component. These activities are associated with a potential kernel-level copy-on-write (COW) page cache corruption vulnerability that could be used for privilege escalation.
Detects the execution of the Linux 'tc' (traffic control) utility with 'act_pedit' by an unprivileged (non-root) user. This pattern is associated with attempts to leverage the CVE-2026-46331 vulnerability, which involves a Copy-on-Write (COW) kernel exploit triggered through malicious netlink operations in the traffic control subsystem to achieve privilege escalation.
Detects execution of known Proof-of-Concept binaries (pedit_cow_demo or packet_edit_meme) followed by /bin/su spawning /bin/sh, which indicates successful exploitation of the pedit COW vulnerability resulting in shellcode execution with root privileges.
Detects a reverse shell executed by the Python interpreter during what should be an isolated AI model loading process. This rule specifically looks for common reverse shell patterns (nc -e, bash -i, sh -i, /dev/tcp/) in the command line of processes initiated by 'python.exe'.
Identifies network connections made by Python immediately after loading safetensors or pickle files, indicating a potential supply chain payload phoning home. The rule joins file events where specific model file types (.safetensors, .pkl, .pth) are loaded with network connection events from the same initiating process within one minute of the file load. It specifically excludes local loopback connections.
Page 243 of 340