Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the creation or modification of the '.vscode/extensions.json' file. This file is critical for managing extensions within Visual Studio Code environments. Attackers can exploit modifications to this file, as demonstrated in recent zero-day attacks, to introduce malicious extensions, potentially leading to code execution or other forms of compromise within a developer's environment. The detection focuses on file system events (creation and modification) targeting this specific configuration file.
Detects suspicious execution or persistence artifacts in /etc/rc.d/ or /usr/local/libexec/ipsec/ on edge firewalls, specifically indicating VerdantBamboo's BRICKSTORM malware on pfSense appliances. The rule looks for process command lines or folder paths containing "/usr/local/libexec/ipsec/blacklist" or modifications to "/etc/rc.d/cron" that include "blacklist".
This rule detects attempts to execute commands via an unauthenticated Docker API. Specifically, it looks for HTTP POST requests to the '/exec' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker daemon access. This could indicate an attacker attempting to gain control or execute arbitrary commands within Docker containers or the host system.
This rule detects attempts to exploit the Shellshock Bash vulnerability via CGI. It specifically looks for HTTP requests containing the string "() {" in the header, which is characteristic of the Shellshock exploit payload used to inject arbitrary commands.
This rule detects HTTP web requests where the URI contains the string "/bin/sh" (case-insensitive). This pattern is often indicative of an attempt to execute a Unix shell command via a web application, which could be part of a command injection attack (ATT&CK T1059.004).
Detects suspicious execution of the Bun runtime executing a JavaScript payload from the /tmp directory, matching the Miasma stage-four execution pattern. This rule specifically looks for the Bun executable running a JavaScript file named 'p<random>.js' within the /tmp directory, which is characteristic of the Miasma credential stealer.
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
This rule detects the delivery of a Linux VDSO (Virtual Dynamic Shared Object) hijack tool via HTTP. It specifically looks for HTTP traffic to a client containing the strings "[vdso]" and "mprotect" (case-insensitive) within the file data. This combination of strings suggests the presence of code designed to manipulate the VDSO, a technique often used for privilege escalation or evasion on Linux systems.
Detects commands that clear interactive shell history or disable history persistence,
consistent with Defense Evasion (impairing command history visibility).
consistent with Defense Evasion (impairing command history visibility).
This rule detects attempts to modify SSH authorized_keys files over a network connection, which could indicate an attacker establishing backdoor access. It specifically looks for the string "authorized_keys" within TCP traffic destined for port 22 (SSH).
This rule detects attempts to write shell event hook scripts, specifically those using 'trap' and 'SIGHUP', over an SSH connection. This activity is often associated with persistence mechanisms where an attacker sets up a script to execute upon certain shell signals, such as a hangup signal, to maintain access or execute malicious code.
This rule detects attempts to register a new system service via a remote SSH connection. It specifically looks for the string "service install" within TCP traffic on port 22 (SSH) flowing from a client to a server within the home network. This activity could indicate an attacker establishing persistence on a compromised system.
Detects suspicious attempts to dump serialized GitHub Actions secrets (JSON) into a text file named 'format-results.txt' for subsequent artifact exfiltration, a technique used by IronWorm. The rule looks for shell commands that use 'echo' to write to 'format-results.txt' and contain references to 'VARIABLE_STORE' or 'secrets', indicating an attempt to exfiltrate sensitive CI/CD environment variables.
Detects a Node.js or npm process attempting to read sensitive credential files such as SSH keys, npm tokens, K8s configurations, cloud credentials, or Vault material. This rule is tuned for the Red Hat Cloud Services supply chain attack by monitoring for Node.js/npm processes executing in the context of the affected packages or preinstall hooks.
Detects creation of AI coding assistant configuration files used by the Miasma worm
for persistence. The malware injects setup scripts into .claude, .cursor, .gemini,
and .vscode directories that execute via Bun on IDE open.
for persistence. The malware injects setup scripts into .claude, .cursor, .gemini,
and .vscode directories that execute via Bun on IDE open.
This rule detects attempts to drop a systemd timer unit file via a web shell. It specifically looks for HTTP POST requests (flow:to_server) containing both '.timer' and '[Timer]' in the client body, indicating the creation or modification of a systemd timer unit.
This rule detects when a cron job is created or modified via a remote SSH session. It specifically looks for the string "crontab -e" within TCP traffic destined for port 22 (SSH), indicating an interactive session where a user is editing their crontab file. This activity, when originating from a remote SSH session, could be indicative of an attacker establishing persistence or scheduling malicious tasks on a compromised system.
This rule detects the string "launchctl load" within TCP traffic on port 22 (SSH). This indicates an attempt to load a launchd service on a macOS or Linux system via a remote SSH connection. This activity could be legitimate system administration but also could be indicative of an attacker establishing persistence or executing malicious services.
This rule detects indicators of compromise (IOCs) associated with the Red Lamassu (JFMBackdoor) campaign. It identifies malicious file hashes, network communication with known command and control (C2) domains and IP addresses, specific file paths and names used by the malware, and registry modifications for persistence. The rule looks for file events, process creations, network connections, and registry changes that match the defined IOCs.
Detects processes attempting to scrape unmasked CI runner secrets from memory, specifically looking for techniques used by the Miasma worm to bypass GitHub Actions secret masking. This rule identifies suspicious command-line patterns indicative of secret extraction, such as searching for 'isSecret' or accessing '/proc/mem' with Python.
Detects post-install execution of the TeamPCP-compromised Microsoft durabletask package
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
Page 267 of 340