Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
This rule detects suspicious process execution patterns on Linux systems, specifically looking for processes running from anonymous memory mappings (memfd), execution via /proc/self/fd (fexecve pattern), and processes masquerading as 'systemd-userdbd' from unexpected file paths. These techniques are often used by adversaries for evasion and persistence.
Detects the execution of known screen capture utilities or commands on Linux systems. This rule looks for processes named 'ffmpeg' or 'grim' and specific command-line arguments often associated with screen recording, such as 'x11grab', 'MJPEG', 'DISPLAY', 'XAUTHORITY', and 'WAYLAND_DISPLAY'. It also flags if the initiating process is 'node', 'systemd-userdbd', or 'npm', which could indicate suspicious activity.
Detects unexpected shell or suspicious utility execution as a child process of media processing or machine learning pipeline services (e.g., ffmpeg, ffprobe, Jellyfin, Nextcloud, Immich, PhotoPrism, vLLM). This behavior can indicate exploitation of vulnerabilities like CVE-2026-8461 (PixelSmash) or other forms of arbitrary code execution, especially when combined with reverse shell indicators or execution by service accounts.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance. This search leverages the Endpoint and Web CIM data models.
Detects the use of 'curl' to download content that is then directly piped to a shell interpreter (bash, sh, zsh). This technique is often used for fileless execution, where a malicious script is executed without being written to disk, as noted in the context of initial Miasma stages.
Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
Detects command lines that reference known supply chain attack targets or commonly used package management tools like npm and pypi, which can be indicators of supply chain compromise.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
Detects the creation or modification of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508. This rule specifically looks for file creation, modification, or renaming events for 'help.php' in paths containing 'redcap'.
Detects the MYRA RAT using the prctl system call to rename its process to 'systemd-userdbd'. This masquerading technique aims to evade detection by blending in with legitimate system processes on Linux endpoints. The rule monitors process execution events for instances of 'systemd-userdbd' that do not originate from authorized system directories.
Detects common anti-forensic staging patterns used by IoT botnets such as TerraBot, r00ts3c, and RondoDox. The rule identifies processes that stage payloads in the /tmp directory, set world-writable execution permissions (chmod 777), and immediately delete artifacts following execution to hinder forensic analysis.
Detects unexpected shell or command interpreter processes spawned as children of the vLLM or Python worker processes. This behavior strongly indicates a successful Remote Code Execution (RCE) payload, such as a system() call, resulting from the CVE-2026-22778 JPEG2000 heap overflow exploit.
Browser extension wallet discovery
Cortex XDR
This rule detects command-line activity that searches for sensitive information within browser extension storage, specifically targeting data related to cryptocurrency wallets, password managers, or authenticator applications. It looks for commands executed by common interpreters like cmd, PowerShell, or Python that include keywords associated with extensions and sensitive data like 'wallet', 'metamask', 'password', 'authenticator', '2fa', or 'crypto'. The rule is designed to provide causality and actor information for investigation.
Detects the execution of processes with command line arguments containing terms related to quantum-resistant or post-quantum cryptography (e.g., lattice, isogeny, multivariate, hash). This is intended to identify the usage of specific cryptographic libraries or tools that may be relevant for advanced adversaries researching post-quantum decryption techniques or securing their own communications against future quantum-enabled decryption.
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Page 248 of 347