Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,144 detections
Filters
Last updated
All Time
Detection languages
3,228
1,086
498
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,979
2,473
1,063
1,026
910
Platforms
39,802
7,144
6,519
3,861
3,601
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,231
1,319
1,319
876
873
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP). This rule specifically looks for connections to 'pack.nppacks.com', 'hblnew.ecompk.com', or the IP address '54.160.138.70'.
Detects the creation of a new MariaDB User-Defined Function (UDF) that loads a shared object (.so or .dll) file. This technique is used in the final stage of the CVE-2026-32710 attack chain to execute arbitrary OS commands, often from suspicious temporary or public directories.
PhantomRaven Temporary Payload Creation
Cortex XDR
Detects Node.js dropping the PhantomRaven dynamic Stage-3 payload into the /tmp directory. The attack utilizes a file-based temporary dropper that operates outside of standard NPM package paths, bypassing static code analysis.
Detects destructive Linux commands such as recursive root directory deletion (rm -rf /*) and random data disk wiping (dd if=/dev/urandom of=/dev/sdX). This behavior has been observed as payloads in indirect prompt injections targeting LLM agents to destroy host filesystems.
Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.
Kubernetes Service Account Token Theft
Cortex XDR
Detects non-legitimate processes attempting to read Kubernetes service account tokens or related sensitive files (ca.crt, namespace) from the standard service account path within containers. This rule filters out common and legitimate Kubernetes system processes to reduce false positives.
Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.
Detects exploitation of CVE-2026-31431 (Copy Fail), a logic flaw in the Linux kernel AF_ALG crypto interface
that allows an unprivileged user to overwrite the page cache of read-only files, including SUID binaries such
as /usr/bin/su, without holding write permissions.
By injecting a payload into the page cache of a SUID binary and executing it, an attacker gains root privileges.
that allows an unprivileged user to overwrite the page cache of read-only files, including SUID binaries such
as /usr/bin/su, without holding write permissions.
By injecting a payload into the page cache of a SUID binary and executing it, an attacker gains root privileges.
This rule detects the execution of commands that include 'splice' in conjunction with common privilege escalation utilities such as 'su', 'sudo', or 'passwd', or attempts to access '/etc/passwd'. This privilege escalation resembles Copy Fail.
Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.
High-confidence detection for probable Copy Fail exploitation requiring AF_ALG or algif_aead references, syscall-style splice usage, and privileged binary targeting. https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py https://xint.io/blog/copy-fail-linux-distributions#how-we-found-it-9
This rule detects the execution of the 'su' command on Linux systems. The 'su' command is used to run commands with a substitute user and group ID, most commonly to switch to the root user. Related to Copy Fail
Detects command-line execution that attempts to access GitHub authentication tokens outside of expected CI/CD or development environments. This could indicate an attempt to steal or misuse credentials.
This rule detects the creation, modification, or execution of files matching a predefined list of known malicious SHA256 hashes. It correlates file and process events to identify the presence and activity of these specific malicious artifacts on monitored systems.
KQL Query
This rule detects the execution of a Python Proof-of-Concept (PoC) script named 'exp.py' followed by the execution of the 'su' binary within a 5-minute window on a Linux system. This correlation is indicative of an attempt to exploit CVE-2026-31431 (Copy Fail), which leverages AF_ALG sockets to overwrite the 'su' setuid binary in memory, aiming to achieve root privileges.
This rule detects processes with a command line containing 'socket' and various cryptographic keywords (copy.fail, algif_aead, authencesn, hmac.*sha256.*cbc.*aes). This combination can indicate suspicious related to Copy Fail CVE-2026-3143
This rule detects the creation of files matching the exfiltration pattern used by the Mini Shai-Hulud malware. Specifically, it looks for files named 'results-<timestamp>-<counter>.json' within a 'results' directory, accounting for both Windows and Unix path separators. This pattern is indicative of data staging or exfiltration activities by the malware.
Detects the creation of an AF_ALG socket (address family 38) by a non-root user. This is a highly unusual action and serves as a primary early warning indicator for CVE-2026-31431 (Copy Fail) exploitation attempts.
Detects authentication or privilege escalation events where a user account that is normally unprivileged suddenly reports as UID 0. This is a direct artifact of modifying the page cache of /etc/passwd in memory, which is the primary post-exploitation phase of the Copy Fail vulnerability (CVE-2026-31431).
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Page 275 of 341