Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
This rule monitors for network communication with a specific known malicious IP address and URL path, as well as the execution or presence of associated malicious file hashes. Additionally, it flags emails involving specific indicators identified as potentially associated with malicious activity.
Detects a specific multi-stage exfiltration pattern characterized by initial reconnaissance/fingerprinting probes against sensitive service endpoints (/health, /docs, /openapi.json) followed by unauthorized access to artifact storage endpoints (/files or /file?name=) from the same device against the same host within a short timeframe.
Detects the execution of command shells or common post-exploitation utilities as child processes of network appliance management services (e.g., VPN gateways, firewalls, web servers). This pattern indicates potential exploitation of public-facing infrastructure where an attacker achieves code execution through the management daemon or its web components.
Detects a suspicious sequence of reconnaissance activities associated with ShinyHunters campaigns targeting PeopleSoft environments. The pattern involves reading '/etc/hosts' using standard utilities ('cat', 'grep', 'awk') followed by rapid network discovery or probing attempts using 'curl', 'wget', 'nmap', or 'nc' from the same host within a 10-minute window.
Detects the creation of ransom or extortion note files within known web server directories immediately following suspicious HTTP activity targeting an internet-facing host. This pattern aligns with known ShinyHunters extortion tactics where applications are exploited to deploy extortion notes.
Detects the deployment and activity of the MeshCentral remote management agent (meshagent), including process execution, service creation, and network communication to MeshCentral infrastructure. This behavior is indicative of unauthorized persistence and remote command-and-control, often associated with post-compromise activity such as that observed by ShinyHunters.
Detects the execution of the GigaWiper malware or the use of common system commands associated with destructive data activities, such as recursive file removal, disk formatting, or secure data overwriting, often used by threat actors for extortion.
Detects autonomous behavior where AI-driven processes attempt multiple network connections (SMB, SSH, HTTP, RDP, WinRM) to diverse targets following failed access attempts. The rule correlates initial failure activity with subsequent credential-related events and new lateral movement traffic from the same agent process within a short window, suggesting adaptive adversary pivoting.
Detects autonomous behavior where AI-driven processes attempt multiple network connections (SMB, SSH, HTTP, RDP, WinRM) to diverse targets following failed access attempts. The rule correlates initial failure activity with subsequent credential-related events and new lateral movement traffic from the same agent process within a short window, suggesting adaptive adversary pivoting.
Detects autonomous behavior where AI-driven processes attempt multiple network connections (SMB, SSH, HTTP, RDP, WinRM) to diverse targets following failed access attempts. The rule correlates initial failure activity with subsequent credential-related events and new lateral movement traffic from the same agent process within a short window, suggesting adaptive adversary pivoting.
Detects autonomous behavior where AI-driven processes attempt multiple network connections (SMB, SSH, HTTP, RDP, WinRM) to diverse targets following failed access attempts. The rule correlates initial failure activity with subsequent credential-related events and new lateral movement traffic from the same agent process within a short window, suggesting adaptive adversary pivoting.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects anomalous discovery behavior originating from known AI agent and development tools (e.g., Claude, Cursor, Aider). The rule monitors for a rapid sequence of commands spanning multiple categories of enumeration (Network, File/Directory, Software, and System) within a short timeframe, which indicates an attempt to map the runtime environment, permissions, or system capabilities.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
Detects the on-disk presence of a malicious Firefox browser extension, 'pdf-para-texto@extensao.local', used for credential or data harvesting. The rule monitors for the creation of its manifest file or XPI package in specific directories, indicating the staging or installation of the malicious extension.
Detects network activity associated with the 'ClickFix' social engineering campaign, which commonly targets users with fake error messages to trick them into executing malicious commands. The rule identifies communication with known malicious infrastructure (domains and IP addresses) found in CommonSecurityLog events, while implementing filters to exclude common security scanners and deduplicating per-host alerts.
Detects anomalous high-volume API requests to machine learning model inference endpoints (e.g., predict, classify, score). This behavior is characteristic of adversarial example crafting, where an attacker sends rapid, near-duplicate requests to estimate gradients or probe confidence scores to manipulate model output.
Detects potential remote code execution triggered by loading untrusted AI model files (e.g., pickle, .pt, .pth, .ckpt) in Python-based environments. The rule identifies suspicious child process execution or the presence of known dangerous deserialization/payload indicators (like os.system, subprocess, or socket) within the command line of common model-loading applications, suggesting a model-based supply chain compromise.
Page 28 of 340