Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,214
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,781
7,128
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects processes referencing confirmed TeamPCP C2 infrastructure or known malicious artifacts from the Trivy supply chain compromise. This includes specific C2 domains/IPs, temporary runner files, and a specific tarball name. It also looks for `entrypoint.sh` executing `grep` for environment variables or SSH-related strings, which could indicate credential access attempts.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects `curl` commands performing `POST` requests with `--data-binary` that are spawned from a process whose command line contains "trivy-action". This behavior is indicative of potential data exfiltration in the context of a compromised Trivy supply chain.
Detects malicious/suspicious systemd generator files for persistence mechanisms
This rule detects the creation of specific files associated with the TeamPCP malware's systemd persistence mechanism. It looks for the creation of '/.config/sysmon/sysmon.py' or '/.config/systemd/user/sysmon.service' which are used to maintain access and download further stages via C2 even if the original vulnerable litellm process terminates.
Detects instances of the openssl command-line tool being used to encrypt data with AES-256-CBC and RSA OAEP padding. This specific sequence matches the credential encryption pattern observed in the Linux/macOS payload of the malicious telnyx PyPI package attributed to TeamPCP.
Detects malicious/suspicious systemd generator files for persistence mechanisms
Detects attempts to discover GitHub runner processes (Runner.Worker or Runner.Listener) using process enumeration tools like pgrep, ps, or grep. Adversaries may use this technique to locate processes carrying secrets on compromised CI/CD runners.
This rule detects artifacts associated with the Auto-Color Linux backdoor. Specifically, it looks for the presence of the malicious library 'libcext.so.2', which mimics a legitimate library, or modifications to '/etc/ld.preload' for persistence and dynamic linker hijacking. It also identifies specific file paths used by the malware, such as '/var/log/cross/auto-color' or files within '/tmp/cross/' with a 'config-err-' prefix.
Detects the execution of processes from the '/tmp/pglog' path or where the binary is named 'pglog'. Threat actor TeamPCP utilizes this specific filename to masquerade their downloaded malicious secondary payload as a legitimate PostgreSQL process, following the compromise of the litellm PyPI package.
Detects the specific OpenSSL command line arguments used by TeamPCP (Trivy compromise) to encrypt stolen credentials before exfiltration using a hybrid AES-256-CBC scheme. This rule looks for the 'openssl' executable being run with 'enc -aes-256-cbc' or 'enc -aes-256' and a passphrase specified via a file using '-pass file:'.
Detects the specific OpenSSL command line arguments used by TeamPCP to encrypt stolen credentials before exfiltration. This rule looks for executions of 'openssl' with AES-256 encryption flags ('enc -aes-256-cbc' or 'enc -aes-256') and the use of a file to pass the encryption password ('-pass file:').
High-fidelity correlation detecting DPRK Contagious Trader npm malware persistence: Node.js process modifying authorized_keys followed by ufw allowing SSH. Targets cryptocurrency traders via poisoned GitHub trading bot repositories.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects the creation or manipulation of the specific archive file (tpcp.tar.gz) used by TeamPCP to bundle stolen credentials. This rule monitors command line activity, cloud process execution, and file system events for references to 'tpcp.tar.gz'.
Detects file creation events for the TeamPCP systemd persistence mechanism, specifically looking for 'sysmon.py' or 'sysmon.service' dropped in hidden user config directories. This persistence mechanism ensures the attacker maintains access and can download further stages via C2 even if the original vulnerable litellm process terminates.
This rule detects processes executing from the `/tmp/pglog` path or with the filename `pglog` within `/tmp/`, which is a known technique used by the TeamPCP threat actor to masquerade malicious binaries as legitimate PostgreSQL processes for post-exploitation activity.
Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.
Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.
Detects SessionReaper webshell activity on Magento e-commerce platforms, including process execution from suspicious media directories.
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
Page 285 of 340