Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects high-frequency outbound network connections to known large language model (LLM) API providers (OpenAI, xAI, Anthropic) originating from a single endpoint within a short timeframe. This activity is indicative of potential API key theft, where an attacker uses a compromised legitimate key to exhaust credit quotas or exfiltrate data via unauthorized API calls, bypassing the intended application.
Detects a non-root user invoking 'busctl call' against the system bus - the core of the
ptrace_may_dream / AccountsService abuse path (CVE-2026-46333 class). Enriched by decoding
the D-Bus call target (service/member), a CallCategory verdict (AccountsService account
modification, systemd run-as-root, polkit, PackageKit, generic mutating call), a burst
counter that surfaces the pidfd_getfd race loop, RiskScore / TriagePriority and DeviceInfo
context. NOTE: the FD-theft primitive itself is invisible to MDE; this detects the busctl
trigger and account-modification aftermath. Detection logic adapted from Elastic Security Labs.
ptrace_may_dream / AccountsService abuse path (CVE-2026-46333 class). Enriched by decoding
the D-Bus call target (service/member), a CallCategory verdict (AccountsService account
modification, systemd run-as-root, polkit, PackageKit, generic mutating call), a burst
counter that surfaces the pidfd_getfd race loop, RiskScore / TriagePriority and DeviceInfo
context. NOTE: the FD-theft primitive itself is invisible to MDE; this detects the busctl
trigger and account-modification aftermath. Detection logic adapted from Elastic Security Labs.
Detects usage of the Rclone utility (or renamed binaries) to transfer data to various cloud storage backends (S3, Mega, pCloud, SFTP, WebDAV). The detection correlates this activity with the execution of common archival tools (7-Zip, WinRAR, TAR) within one hour prior to the data transfer, which is a common behavior of adversaries preparing data for exfiltration.
Detects the creation of application-specific passwords named 'ZimbraWeb' in Zimbra environments. This pattern is associated with potential persistence mechanisms or credential access attempts where an adversary creates a dedicated service or app password to maintain access, as identified in CVE-2025-66376.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Detects the creation of scheduled tasks (Windows), cron jobs (Linux), or systemd timers where the initiating process is a common scripting or runtime interpreter (e.g., Python, Node.js, PowerShell, Java). This activity is often indicative of persistence mechanisms being established by a compromised agent or script-based process.
Detects unauthorized creation or modification of AI agent system prompts, guardrails, or policy configuration files. This rule monitors for changes made by processes or users other than those identified as authorized CI/CD deployment agents or service accounts, helping to prevent unauthorized tampering with AI agent behavior or safety policies.
Identifies suspicious processes performing beacon-like network communications with rare external destinations. The rule detects consistent hourly activity intervals and high connection counts to endpoints rarely contacted by other devices in the organization, serving as a heuristic for automated C2 beaconing.
Detects unauthorized processes attempting to read sensitive wallet extension storage files or desktop application wallet data folders, a behavior characteristic of the Psychedelic Stealer malware designed to harvest cryptocurrency credentials prior to exfiltration.
Detects instances where a Python process spawns a command-line shell (cmd.exe, powershell.exe, or bash) within 15 seconds of starting, while executing common reconnaissance or utility commands. This behavior is indicative of malicious code executing at import-time, a technique often associated with supply chain compromises in Python packages.
This rule detects potential persistence via Python environment variable manipulation (PYTHONPATH) followed by suspicious network activity from a child process of python.exe. It specifically looks for the modification of the PYTHONPATH environment variable using PowerShell on Windows or shell configuration files on Unix-like systems, followed by a python.exe-initiated network connection (like curl) to external domains, which may indicate the execution of a malicious sitecustomize.py hook.
This rule detects instances where Python package management processes (pip or python) perform build or installation tasks, immediately followed by an outbound network connection initiated by the same process tree to a non-PyPI domain. This behavior is indicative of a supply chain attack where a malicious package contains code (e.g., in setup.py) that beacons to an attacker-controlled server upon installation.
This rule monitors the software inventory for vulnerable versions of OpenSSL and WolfSSL libraries. Specifically, it flags instances of WolfSSL prior to version 5.9.4, which are susceptible to peer-authentication bypass vulnerabilities. The rule is intended for patch management and asset exposure tracking rather than detecting active exploitation.
Detects the execution of the 'fanout.sh' utility from the /tmp directory, which subsequently spawns 'sshpass' child processes to perform rapid, non-interactive SSH authentication attempts ('StrictHostKeyChecking=no') against multiple internal hosts within a 10-minute window. This behavior is indicative of automated lateral movement, specifically observed by threat actor UNC6240.
Detects the execution of known Python scripts (CES_Enroll.py, ntlm_ces_relay.py, ces_negotiate_ntlm.py) often associated with NTLM relay attacks or forced authentication techniques. These scripts leverage Python to interact with authentication protocols or relay requests.
Detects the creation or modification of scheduled tasks (crontab entries) initiated by processes commonly associated with Citrix NetScaler ADC/Gateway appliances (nsppe, httpd, nscollect). This behavior is often indicative of persistence mechanisms used by attackers following an initial exploit on an edge network device.
Detects suspicious child processes such as shell interpreters, download utilities, and base64-decoded commands spawned from core Citrix NetScaler processes (nsppe, httpd, aoacli, nscli). This pattern is often indicative of post-exploitation command execution following an exploitation of remote code execution (RCE) vulnerabilities.
This rule detects potential anti-forensic activity on Citrix ADC/NetScaler devices by monitoring for two primary indicators of log tampering: an unexpected drop in syslog volume to zero following a period of activity, or the execution of explicit commands intended to clear audit logs and configuration files.
Detects anomalous activity where AI assistant processes (e.g., Claude, ChatGPT, GitHub Copilot) execute a high volume of diverse discovery commands. The rule correlates multiple discovery categories, such as account, network service, system information, and network configuration discovery, occurring within a short timeframe to identify potential abuse of AI-integrated development tools for host reconnaissance.
This rule detects the execution or presence of specific Go or Terraform modules known to be malicious or associated with suspicious dependency retrieval. It monitors command-line activity from terraform.exe/go.exe attempting to download/run from these paths, as well as file system events involving these specific folder paths and filenames.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
Page 28 of 347