Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects suspicious child processes spawned by Langflow or n8n workflow services, indicating potential unauthenticated Remote Code Execution (RCE) exploitation. The rule specifically looks for these applications (or their underlying node/python processes) spawning common shell processes (cmd.exe, powershell.exe, bash, etc.) which then execute commands typically associated with RCE payload retrieval or execution (wget, curl, Invoke-WebRequest, base64, iex, Invoke-Expression).
Detects HID keystroke injection attacks from hardware implants
Detects relocation of malware to new paths to evade detection signatures
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts' for target identification. The rule looks for multiple SSH connections within a 10-minute window from a single host and user, specifically targeting common PeopleSoft-related usernames.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
An unprivileged user can gain root access on major Linux distributions by exploiting CVE-2026-31431, a deterministic 4-byte page cache write bug in the authencesn cryptographic template.
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
Vulnerability affects Linux Kernel version starting 4.14 before 6.18.22.
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
Vulnerability affects Linux Kernel version starting 4.14 before 6.18.22.
Detects reading of process memory via /proc filesystem for credential extraction
Detects systemd timer unit file creation for Linux scheduled task persistence
This rule alerts when a new format-check workflow is created matching malicious supply-chain templates. These workflows run on every push and can steal secrets. Require security review for all new workflow files. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
Detects large HTTPS uploads used for data exfiltration over encrypted channels
Detects C2 configuration retrieval via Pastebin and similar dead drop services
Detects install-time commands from the Triple Cross eBPF rootkit deployer that attach a BPF
filter to a host NIC via traffic control (tc). The rootkit hijacks execve and other syscalls
from kernel space to hide processes, files, and traffic while maintaining C2 access.
filter to a host NIC via traffic control (tc). The rootkit hijacks execve and other syscalls
from kernel space to hide processes, files, and traffic while maintaining C2 access.
Detects web shell files written to web server directories
Detects downloads of typosquatted packages from npm or PyPI
Detects use of raw sockets for implementing socket filter backdoors
Detects Unix shell commands executed via web application context
Detects pulling of potentially malicious container images from registries
Detects web shell files written to web server directories
Detects downloads of typosquatted packages from npm or PyPI
Page 263 of 347