Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the execution of script interpreters (such as PowerShell, cmd, bash, python, etc.) where the command line contains non-ASCII characters, specifically Cyrillic, Arabic, or Chinese Unicode characters. This pattern can be indicative of obfuscation techniques used by adversaries to evade detection or to target specific regions.
Detects upload of backdoored container images to internal registries
Blockchain eth_call Command Resolution
Cortex XDR
This rule detects JSON-RPC 'eth_call' usage originating from a non-browser process, which could indicate dynamic command or address resolution related to blockchain interactions. The XQL view retains actor and causality fields to aid in investigation.
Identifies `grep` or `findstr` utilizing decoded regex patterns searching for cloud environment variables locally, specifically looking for patterns like AKIA (AWS Access Key ID), xoxb (Slack Bot User OAuth Token), ghp_ (GitHub Personal Access Token), or npm_ (NPM Access Token). This activity is then correlated with network connections to a specific IP address (216.126.225.129), which is associated with the Megalodon CI/CD malware.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
Detects the host-level command execution artifact left behind by the published ITScape (CVE-2026-46316) exploit proof-of-concept. The PoC specifically executes a payload containing '/bin/touch /ITScape' after achieving host kernel privilege from a KVM/arm64 guest. This rule looks for processes executing this specific command string.
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
Detects the bun setup.mjs execution acting as a parent, spawning further suspicious processes like curl or bash. This behavior is indicative of potential supply chain compromise where a legitimate-looking setup script executes malicious commands.
Detects creation of dot-prefixed hidden files used to hide malware on Linux/macOS
Detects modification of PAM configuration files allowing authentication bypass
Detects VNC connections used for visual remote desktop lateral movement
Links the execution of the initial setup.mjs payload to network traffic bound for audit.checkmarx.cx. This rule detects the execution of 'setup.mjs' via 'bun' followed by network communication to 'audit.checkmarx.cx' within a 10-minute window, indicating potential supply chain compromise activity.
Detects Java or WebLogic processes spawning command interpreters on an application server, which may indicate successful remote code execution.
Detects when non-Node.js scripts, specifically Python or Bash/Shell, modify or create a 'package.json' file. This activity can indicate an attempt to silently inject malicious dependencies into clean repositories, a technique observed with malware like Miasma.
Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.
Detects outbound network connections to 'git-tanstack.com', a typosquatted domain identified as part of the Miasma npm supply chain attack, indicating potential command and control communication.
Detects the collection of system UUIDs or Machine IDs by non-standard processes. This activity is often associated with malware like Miasma, which uses this data to uniquely fingerprint compromised hosts for its botnet registry.
Detects the execution of bash, python, or node scripts originating from the /tmp directory. This is a common staging location for malicious droppers and scripts.
Detects changes to file permissions (chmod +x) for files located within the /tmp directory. This activity is often observed with malware droppers, such as Miasma, which use this technique to make downloaded payloads executable before launching them.
Detects commands enabling the malicious update-monitor or gh-token-monitor systemd services to start automatically on system boot.
Page 264 of 347