Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects when AI agent processes establish listening connections on network ports, indicating potential unauthorized service exposure or lateral movement activity.
This rule broadly searches for the unique dead drop string 'OhNoWhatsGoingOnWithGitHub' across all command line executions, independent of node/bun, indicating potential compromise related to the Mini Shai-Hulud supply chain attack.
This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.
Detects the simultaneous creation of .pkg_history and .pkg_logs in a temporary directory, indicating the setup.cjs dropper associated with the Mastra NPM supply chain attack.
Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.
Identifies rapid dropping of many distinct files deep within the .npm/_npx/ directory structure, a precursor to worm execution. This rule specifically looks for more than 20 distinct file creations within a 5-minute window in paths matching the regex ".npm[\]_npx[\][0-9a-fA-F]+".
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific sequence involves echoing 'runner ALL=(ALL) NOPASSWD:ALL' into a file within the /mnt/runner directory and then changing its permissions to 0440, indicative of a privileged modification to the sudoers file within a containerized GitHub Actions runner environment.
Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.
Detects attempts to overwrite web server content files for defacement
Detects access to SSL/TLS private key files by unauthorized processes
Detects download of attacker tools via C2 ingress transfer channels
Detects use of trap command to handle system signals for Linux persistence
Detects the use of sshpass combined with disabled strict host key checking. This pattern matches the propagation scripts used by UNC6240 for rapid lateral movement across internal nodes following Oracle PeopleSoft exploitation.
Detects high-volume use of AI APIs potentially for generating attack content
Detects unauthenticated access to Docker daemon API for container escape
Detects installation of rootkit kernel modules for deep system hiding
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects suspicious chmod commands used to hide or protect malware
This rule detects when package managers like npm, bun, or pnpm access SSH private key files. Such activity can indicate a supply chain attack where a malicious package attempts to exfiltrate sensitive credentials, granting unauthorized access to servers. If this alert fires, investigate the initiating process, check for newly installed software, and audit server logins associated with the compromised SSH key. Involve your security team if the cause is unclear.
This rule detects when a child process of npm (node, bun, or npm itself) reads a Kubernetes service account token file. This activity can indicate a compromised package attempting to access internal Kubernetes clusters from a developer's machine. Such an event warrants investigation into recent software installations or user activity, and engagement with the security team if the cause is unclear.
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
Page 261 of 347