Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the use of 'docker cp' or 'sbx cp' commands which are susceptible to the CVE-2026-17106 (CopyEscape) vulnerability. This vulnerability allows a compromised container to perform arbitrary file writes or overwrites on the host system during archive extraction, potentially leading to container escape and privilege escalation by replacing critical system binaries like runc.
This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered.
Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones.
This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones.
This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects unauthenticated path traversal attempts targeting Grav CMS web servers. The rule identifies HTTP requests containing directory traversal sequences (e.g., ../, %2e%2e%2f) directed at sensitive configuration files (.yaml) or directories (/user/config, /system/config), consistent with exploitation patterns such as CVE-2026-42608.
This rule detects potential exploitation attempts targeting the Splunk REST API (CVE-2026-20253) by monitoring for unauthenticated inbound requests to the /services/ path. It specifically looks for requests that lack the required Authorization or Cookie headers.
This rule detects potential command injection attacks targeting the Zimbra 'swatchdog' service, specifically involving the abuse of SNMP trap notifications (CVE-2026-73570). The attack works by injecting malicious shell metacharacters into the 'zimbra-MIB::zmServiceName' argument, which is processed by a Perl-invoked 'swatchdog' script. The rule monitors process execution events for shell commands spawned by the swatchdog utility that contain suspicious shell operators and the targeted MIB parameter.
This rule detects potential command injection attacks targeting the Zimbra 'swatchdog' service, specifically involving the abuse of SNMP trap notifications (CVE-2026-73570). The attack works by injecting malicious shell metacharacters into the 'zimbra-MIB::zmServiceName' argument, which is processed by a Perl-invoked 'swatchdog' script. The rule monitors process execution events for shell commands spawned by the swatchdog utility that contain suspicious shell operators and the targeted MIB parameter.
This rule detects potential brute-force activity against remote access services (OpenVPN, StrongSwan, WireGuard, and SSH) on Linux hosts by monitoring Syslog for patterns indicating repeated failed authentication attempts. It further highlights instances where a burst of failed attempts is followed by a successful authentication for the same source IP, indicating a potential successful compromise.
Detects the creation of files with potentially executable extensions (e.g., .php, .jsp, .pl, .cgi, .sh, .py) within NetScaler web-accessible directories. This behavior is indicative of an adversary attempting to deploy a web shell for persistence or command execution following a successful exploit of the web application.
Detects the suspicious combination of a file modification within Magento frontend or checkout JavaScript/template directories followed by an outbound network connection initiated by web server processes (e.g., Apache, Nginx, PHP). This pattern is consistent with the injection of a digital skimmer (e.g., Magecart style) and the subsequent exfiltration of stolen payment card data to an attacker-controlled endpoint.
Detects attempts to redirect Python package resolution away from the default PyPI index. This is achieved by monitoring pip CLI arguments (--index-url, --extra-index-url), environment variables (PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, PIP_CONFIG_FILE), or the creation/modification of pip configuration files (pip.conf, pip.ini). Such activity is often associated with software supply chain attacks where an adversary attempts to force the installation of malicious packages from a controlled repository.
Detects repeated SSH authentication failures originating from an external source on port 22, where the username pattern appears to be programmatically generated or enumerated (e.g., username followed by digits). This behavior is characteristic of automated brute-force attempts targeting common SSH services.
This rule detects network beaconing behavior consistent with Cobalt Strike's default malleable C2 profiles. It monitors HTTP GET and POST requests for specific URI patterns commonly used by default Cobalt Strike configurations and triggers when multiple such requests are observed from a single host over a 15-minute window.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
Detects network or system activity associated with the 'p2pwn' backdoor account on Dahua cameras, which is introduced by exploiting the CVE-2024-39943 vulnerability. The rule monitors for the presence of 'p2pwn' and 'p2password' strings across logs, including RPC/login events.
Detects the creation of web scripts (aspx, php, jsp) in typical web server directories followed by suspicious shell activity (cmd, powershell, or shell execution) originating from web server processes within a 10-minute window. This behavior is indicative of a web shell being dropped and subsequently utilized for command execution.
This rule identifies installations of TeamViewer software that are vulnerable to specific CVEs (CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92370, CVE-2026-92371) by analyzing the 'DeviceTvmSoftwareInventory' dataset. It checks for versioning patterns against known vulnerable build numbers across Windows, Linux, and macOS platforms to pinpoint systems requiring patching.
This rule identifies installations of TeamViewer software that are vulnerable to specific CVEs (CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92370, CVE-2026-92371) by analyzing the 'DeviceTvmSoftwareInventory' dataset. It checks for versioning patterns against known vulnerable build numbers across Windows, Linux, and macOS platforms to pinpoint systems requiring patching.
Detects the creation of scheduled tasks (Windows), cron jobs (Linux), or systemd timers where the initiating process is a common scripting or runtime interpreter (e.g., Python, Node.js, PowerShell, Java). This activity is often indicative of persistence mechanisms being established by a compromised agent or script-based process.
This rule detects anomalous spikes in network connections from a device to major LLM provider API endpoints (OpenAI, Azure OpenAI, Anthropic) by establishing a baseline for each device and identifying deviations exceeding a statistical threshold. Such behavior may indicate unauthorized data exfiltration or mass data processing using LLM services.
Detects when an AI agent's code execution sandbox (e.g., Python, Node.js, or Shell interpreters) initiates suspicious child processes. This includes the execution of network utilities for potential C2 (e.g., curl, nc, socat), the creation of interactive reverse shells, or the execution of credential harvesting tools (e.g., mimikatz, secretsdump), which suggests the AI agent's sandbox environment has been compromised or abused.
Page 26 of 347