Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of suspicious child processes (e.g., cmd.exe, powershell.exe, bash, wget) spawned by processes associated with public-facing appliances like Fortinet SSL-VPN, Veeam Backup & Replication, Citrix ADC, and cPanel/WHM. This behavior is often indicative of exploitation of public-facing applications (T1190) for initial access, frequently associated with ransomware actors targeting unpatched infrastructure.
Detects anomalous outbound network connections initiated by security and developer tooling (Trivy, Checkmarx, LiteLLM, Telnyx). This behavior is consistent with supply-chain attacks, such as those attributed to the UNC6780/TeamPCP threat group, where compromised tooling is leveraged to exfiltrate sensitive cloud credentials or API keys to external, non-vendor infrastructure.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
This rule identifies Linux-based devices that are vulnerable to specific security flaws tracked under CVE-2026-64507 and CVE-2026-64508. It correlates vulnerability assessment data with device inventory to highlight exposed systems.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
This rule detects outbound network connections originating from managed devices where the remote URL or domain matches known underground LLM-based services, such as WormGPT, FraudGPT, or EvilGPT, which are often used by threat actors for malicious activities like generating phishing content or malware.
This rule detects network connections from internal devices to a specific remote IP address (134.122.155.135) over port 443. This is characteristic of communication with a known or suspicious Command and Control (C2) server.
Detects unauthenticated GET requests to known AI and machine learning infrastructure management endpoints (e.g., DCGM, Ray, Kubeflow) that are commonly exposed without authentication. These interfaces provide operational metrics, cluster status, or job management details, which can be leveraged for reconnaissance.
Detects an exploitation attempt against a known SQL injection vulnerability (CVE-2026-62262) in the Piwigo photo gallery application, specifically targeting the 'pwg.images.filteredSearch.create' method via the 'ratings' parameter. The detection monitors inbound HTTP traffic for common SQL injection patterns like UNION SELECT, SLEEP commands, and boolean-based injection payloads.
Detects high-volume SSH authentication attempts originating from a single source IP targeting a server on port 22, indicating a potential brute force attack.
Detects outbound network traffic matching Stratum protocol JSON-RPC methods (mining.subscribe, mining.authorize, mining.submit) typically used by XMRig and other cryptomining software to communicate with a mining pool. The rule monitors for established TCP connections on non-standard ports, excluding common web ports 80 and 443.
Detects the execution of Python 3.12 commands via 'sudo' to elevate privileges to 'root'. The rule monitors for instances where a non-root account invokes 'sudo python3.12' and subsequently spawns a process or logs activity confirming a root-level execution session within a short time window.
Detects evidence of the SCKit supply chain worm within GitHub Actions CI pipelines. The rule identifies attempts to poison the build process by injecting a BASH_ENV path into GITHUB_ENV, which forces the execution of a malicious script (sckit-publish-bridge.sh) during subsequent shell steps. This script is designed to exfiltrate npm publishing credentials (NODE_AUTH_TOKEN) to external infrastructure. The detection logic covers both the injection mechanism and diagnostic output indicators from the bridge script.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects unauthorized attempts to interact with the Docker API to create containers or pull images, specifically looking for patterns associated with the CARBONATO worm which utilizes the /containers/create endpoint with 'net-setup' parameters.
Detects incoming HTTP POST requests to the Docker API endpoint '/containers/create' containing 'Privileged: true' and a bind mount to the host filesystem ('/:/host'). This pattern is indicative of an attempt to deploy a privileged container with host access, which can be leveraged for container breakout or host system compromise.
Detects the presence of the 'SOUL.md' configuration file associated with the Hermes Agent AI framework. This file contains a specific 'GH0ST' persona prompt designed to bypass ethical restrictions (jailbreak) and configure the agent for automated post-exploitation tasks, such as loot collection and Telegram-based command and control.
Detects evidence of persistence mechanisms associated with the CARBONATO botnet on Linux systems. This includes the application of chattr +i to the malicious watchdog binary, the execution of the auto-persist-host.sh script, the enabling of the docker-network-resolver systemd timer, or modifications to crontab for watchdog execution.
Detects instances where the XMRig cryptominer is masquerading as the legitimate systemd-logind process on Linux hosts. The rule triggers on process execution of /usr/sbin/systemd-logind coupled with suspicious outbound network connections to known mining pools or mining-related ports.
Detects the creation of files containing AI provider API keys within the /root/.hermes/loot/ directory, consistent with credential harvesting behavior observed by the CARBONATO GH0ST agent.
Detects the suspicious combination of a file modification within Magento frontend or checkout JavaScript/template directories followed by an outbound network connection initiated by web server processes (e.g., Apache, Nginx, PHP). This pattern is consistent with the injection of a digital skimmer (e.g., Magecart style) and the subsequent exfiltration of stolen payment card data to an attacker-controlled endpoint.
Page 29 of 340