Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation or modification of Git pre-commit hooks (.githooks/pre-commit). Contagious Interview actors use this technique to automatically execute malicious code when a target clones and interacts with a compromised repository.
Detects suspicious process execution patterns associated with the Miasma worm, which attempts to scrape GitHub Actions Runner.Worker process memory to extract masked secrets. This rule looks for specific command-line arguments used by memory dumping tools or scripts targeting the GitHub Actions Runner.Worker process, including `grep` for secret JSON structures, `python` targeting `/proc/pid/mem`, and specific shell pipeline combinations observed in Miasma payloads.
Detects the execution of 'memdump', a utility that captures physical or process memory, indicating potential memory scraping activity.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
Detects piping 'echo' directly into 'crontab -' to install cron jobs non-interactively, a standard method for scripted persistence.
Detects Python scripts making outbound network connections directly to IP addresses without prior DNS resolution. This behavior can strongly indicate hardcoded Command and Control (C2) communication, where an adversary has embedded the C2 server's IP address directly into the script to bypass DNS-based security controls or to ensure connectivity even if DNS is compromised or unavailable. The rule filters out private IP addresses and aggregates connections by device and remote IP, flagging those with a low connection count (less than 10) to reduce noise from legitimate, high-volume bare-IP traffic.
Detects the creation of temporary files containing harvested tokens in the /tmp/ directory. This activity is indicative of a script using these files as a staging ground before network exfiltration. The rule specifically looks for file creation events in '/tmp/' where the filename contains 'tokens' and the initiating process is a common shell or text processing utility.
Detects the deployment of the 'session-manager.php' MU-Plugin backdoor characteristic of the ErrTraffic 'Analytics' cluster on WordPress servers by monitoring file creation events in the 'wp-content/mu-plugins' directory for the specific filename 'session-manager.php'.
Detects the Linux ZiChatBot component executing from the obsHub temporary directory with the obs-check-update name after being made executable. This rule specifically looks for process creation events where the executable name is 'obs-check-update' and the file path is within '/tmp/obsHub/' or '/var/tmp/obsHub/'.
Detects the use of curl with specific command-line flags (-kfsSL) commonly used by Amos Stealer to silently download its initial payload, bypassing TLS warnings and hiding output. This behavior is indicative of an adversary attempting to transfer tools or malware onto a system without user interaction or visible output.
Detects access to AWS credentials files for cloud account credential theft
Detects repeated SSH authentication failures indicating brute force
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
Detects indicators of the June 2026 Mastra npm supply chain attack, in which
144 @mastra/* packages were compromised by injecting a typosquatted dependency
'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated
postinstall infostealer. The payload disables TLS validation, fetches a
second-stage payload, executes it as a detached process, and self-deletes.
Detection targets the malicious dependency reference, the postinstall execution
chain, and TLS-validation-disabling behaviour.
144 @mastra/* packages were compromised by injecting a typosquatted dependency
'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated
postinstall infostealer. The payload disables TLS validation, fetches a
second-stage payload, executes it as a detached process, and self-deletes.
Detection targets the malicious dependency reference, the postinstall execution
chain, and TLS-validation-disabling behaviour.
Detects command-line installation of VS Code extensions (.vsix) launched by script interpreters. Threat actors like UNK_DeadDrop use this technique to silently install malicious extensions via VBScript and CMD payloads.
Detects the creation or modification of VS Code tasks.json files outside of normal IDE or version control operations. Threat actors, such as North Korean groups, are weaponizing the "runOn: folderOpen" feature in tasks.json for auto-execution when a cloned repository is opened.
Detects searching of bash history files for credentials
Detects anomalous outbound network connections originating from the Python/vLLM process to irregular ports or cloud metadata IPs. This behavior may indicate command-and-control establishment, secondary staging, or cloud metadata pivoting following a successful CVE-2026-22778 exploit.
Detects the exploited Bomgar process explicitly attempting to read sensitive credential files (like the SAM registry hive dump or /etc/shadow) to escalate privileges.
Maps the behavioral transition where the Bomgar process spawns a child process that immediately executes commands requesting or manipulating SYSTEM or root level privileges.
Detects CI/CD runners utilizing inline base64 decoding to execute malware payloads, specifically looking for processes that use 'base64 -d' in their command line and also initiate network connections to a known malicious IP address (216.126.225.129) while using 'curl' or 'wget'.
Page 256 of 347