Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Identifies rapid dropping of many distinct files deep within the .npm/_npx/ directory structure, a precursor to worm execution. This rule specifically looks for more than 20 distinct file creations within a 5-minute window in paths matching the regex ".npm[\]_npx[\][0-9a-fA-F]+".
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific sequence involves echoing 'runner ALL=(ALL) NOPASSWD:ALL' into a file within the /mnt/runner directory and then changing its permissions to 0440, indicative of a privileged modification to the sudoers file within a containerized GitHub Actions runner environment.
Detects creation, modification, or renaming of 'help.php' within a REDCap application path. This activity is indicative of a web shell deployment, as observed by GTIG with UNC6508 using 'help.php' for persistence and payload uploads. The combination of the campaign-specific filename and REDCap path provides a high-confidence signal.
Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.
Detects attempts to overwrite web server content files for defacement
Detects access to SSL/TLS private key files by unauthorized processes
Detects download of attacker tools via C2 ingress transfer channels
Detects use of trap command to handle system signals for Linux persistence
Detects creation of disposable email accounts used for attack infrastructure
Detects high-volume use of AI APIs potentially for generating attack content
Detects unauthenticated access to Docker daemon API for container escape
Detects installation of rootkit kernel modules for deep system hiding
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects suspicious chmod commands used to hide or protect malware
This rule detects when a child process of npm (node, bun, or npm itself) reads a Kubernetes service account token file. This activity can indicate a compromised package attempting to access internal Kubernetes clusters from a developer's machine. Such an event warrants investigation into recent software installations or user activity, and engagement with the security team if the cause is unclear.
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
Detects a compiled Python extension writing .py or .pyc files into a temporary or profile directory for later execution. This behavior is often associated with malware that uses Python for its runtime logic, where the compiled Python code (e.g., from Cython) extracts and drops the actual Python scripts for execution.
Detects the use of sshpass combined with disabled strict host key checking. This pattern matches the propagation scripts used by UNC6240 for rapid lateral movement across internal nodes following Oracle PeopleSoft exploitation.
Detects the creation of a Python launcher file with a '.mod' extension in temporary or user library directories by common script hosts (node, python, wscript, cscript, powershell). This activity is indicative of the InvisibleFerret malware (also known as Void DoKkaebi or BeaverTail) which uses such launchers to import newly downloaded .pyd or .so extensions and supply runtime connection arguments.
Detects the execution of 'update.py' from a hidden local share, specifically '.local/share/updater/update.py'. This path is a known persistence mechanism utilized by the Miasma toolkit.
Detects the creation of macOS/Linux LaunchAgent property list files associated with 'gh-token-monitor', indicating potential persistence for the Miasma malware family on macOS environments.
Page 254 of 340