Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Identifies devices with FFmpeg installations below version 9.0 that include the vulnerable MagicYUV decoder (libavcodec), exposing the host to heap out-of-bounds write RCE via crafted AVI, MKV, or MOV files (CVE-2026-8461).
Detects the execution of base64 decoded strings directly outputted from scripting processes, which is a common technique for obfuscation and payload delivery.
Detects automated execution of hidden workspace scripts triggered upon opening IDE folders, specifically looking for bash or sh processes executing 'vendor/run-update.sh' initiated by VS Code or Cursor.
Detects the execution of the Chisel client establishing a reverse SOCKS tunnel with authentication. This activity is often associated with adversaries using Chisel for command and control or data exfiltration.
Detects REDCap-associated PHP or web server processes launching operating system command interpreters. GTIG observed INFINITERED using trojanised REDCap components and web shell functionality to execute arbitrary shell commands. This behaviour is highly unusual for normal REDCap operations and may indicate post-exploitation activity.
Detects PHP or web server processes launching archive and compression utilities. A compromised web application may use these tools to package REDCap files, database exports, credentials, or research data before exfiltration. This behaviour should be rare outside documented backup or deployment activity.
This rule correlates the modification of 'Upgrade.php' with subsequent changes to REDCap authentication, login, or hook-related PHP files on the same device within a 30-minute window. This activity is indicative of the INFINITERED threat actor's technique to intercept the REDCap upgrade process and reinject credential harvesting, backdoor, and persistence code into new software versions. Such a sequence should be compared with approved maintenance windows and expected deployment activity to identify malicious behavior.
Detects headless browsers managed by AI agents making Cross-Site WebSocket Hijacking connections to localhost. Specifically, it looks for network connections initiated by processes with 'playwright' or 'MultimodalWebSurfer' in their command line, connecting to localhost (127.0.0.1 or ::1) on ports 8080 or 8081.
Detects the creation of systemd unit files masquerading as Google Chrome components used to launch the GS-Netcat backdoor on boot.
Correlates the execution of the trojanized scp binary passed with the '!' flag, an internal trigger designed to disable SELinux enforcing mode prior to payload execution. This rule specifically looks for 'scp' command-line executions containing '!' and excludes standard scp syntax that might contain '@' for user@host.
Detects PHP runtime processes anomalously accessing the .env file, bypassing normal application routing to directly scrape database credentials.
Detects cron job creation for Linux persistence or execution
Detects web server processes (IIS/Nginx) spawning native Windows or Linux shells (cmd.exe, sh), immediately followed by reconnaissance or download tool execution.
Identifies Python-based LLM agents (LangChain, etc.) blindly passing unsanitized, prompt-injected strings to native command shells (cmd, bash). This rule specifically looks for Python processes initiating command shell executions where the command line of the shell contains common data exfiltration or remote access tools like curl, wget, nc, or base64.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Detects searching of bash history files for credentials
Detects attempts to escalate privileges via sudo
This YARA rule detects the presence of a credential stealer by identifying a cluster of file names commonly associated with Firefox profile data. The rule specifically looks for at least five out of seven distinct file names: 'key4.db', 'cert9.db', 'cookies.sqlite', 'logins.json', 'formhistory.sqlite', 'places.sqlite', and 'prefs.js'. These files are critical components of a Firefox profile, storing sensitive information such as encryption keys, certificates, cookies, login credentials, browsing history, and user preferences. The co-occurrence of these file names within a scanned target suggests an attempt to access, exfiltrate, or manipulate Firefox user data, often indicative of malware like credential stealers.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Page 251 of 340