Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
Detects Python enumerating browser extensions and desktop wallet paths associated with cryptocurrency key material. This rule specifically looks for Python processes executing with command-line arguments containing keywords related to cryptocurrency wallets (e.g., 'wallet', 'keystore', 'metamask').
Detects Python recursively searching repositories for .env files, package credentials, API keys, access tokens, or connection strings. This activity is associated with the InvisibleFerret malware.
Detects Python creating an archive containing browser, wallet, developer, cloud, and authentication data from multiple collection roots. This activity is associated with the InvisibleFerret malware.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Detects a small Go-based scanner, identified by its renamed executable 'go.exe', when launched with command-line arguments indicative of broad network scanning activities such as CIDR range specifications (/16, /24), service discovery, or exploit module usage. This behavior is often associated with initial access or reconnaissance phases by adversaries.
Detects the execution of base64 decoded strings directly outputted from scripting processes, which is a common technique for obfuscation and payload delivery.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Detects curl commands transmitting harvested GitHub tokens (ghp_ prefix) in the request body, representing the final exfiltration stage of gh-token-monitor.
Detects headless browsers managed by AI agents making Cross-Site WebSocket Hijacking connections to localhost. Specifically, it looks for network connections initiated by processes with 'playwright' or 'MultimodalWebSurfer' in their command line, connecting to localhost (127.0.0.1 or ::1) on ports 8080 or 8081.
Detects vLLM spawning download utilities like curl or wget to pull secondary payloads post-exploitation, potentially indicating a compromise related to CVE-2026-22778.
Detects Linux execution environments where processes manually manipulate their argv[0] to masquerade as kernel threads ([khubd]) or legitimate daemons (smbd -D). The rule specifically looks for process command lines matching 'khubd', 'smbd -D', or 'kauditd -sh' where the actual executable filename is not 'smbd', 'kauditd', or 'khubd'.
Detects PHP runtime processes anomalously accessing the .env file, bypassing normal application routing to directly scrape database credentials.
Hunts for the creation of hidden keylogger output files formatted with MD5 hashes (s<MD5> or c<MD5>) within the deceptive /usr/share/man9/ph/ directory, as observed in Velvet Ant activity.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects rclone remote configuration or config file creation when the binary is running from a portable user writable location, such as Downloads, Temp, AppData, Desktop, /tmp/, or /var/tmp/. This activity can indicate an attempt to exfiltrate data to cloud storage services.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
Detects CI/CD runner agents calling 'aws configure list-profiles' and connecting to a known malicious IP address (216.126.225.129), as prescribed by the Megalodon CI/CD malware.
Detects suspicious cron utility activity, including modifications or executions, with specific indicators associated with the MYRA malware family. This rule identifies attempts to establish persistence or execute malicious code via scheduled tasks on Linux systems.
Detects the execution of curl commands that involve base64 decoding, often used by adversaries to download and execute obfuscated scripts or payloads. The rule specifically looks for common shell utilities (curl, zsh, bash, sh) executing commands containing 'base64 --decode' and 'curl', along with specific suspicious domains or a generic base64 encoded string pattern.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
Page 254 of 347