Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects creation of backdoor accounts with high privileges such as root.
Detects Windows PE files that contain string indicators associated with the Diaoyu loader as reported in the Shadow Campaigns research. The rule keys on multiple distinctive strings, including references to WordPress themed artefacts, a GitHub raw content host, and Diaoyu specific markers, and requires an MZ header plus either two or more indicators or specific high confidence string pairs.
This rule detects Python processes that are executed with command-line arguments indicative of silent execution or output redirection to null devices, combined with execution from a temporary directory. This pattern was observed in the dYdX PyPI package compromise, where a RAT ran undetected using these techniques.
Detects when the BeyondTrust remote support client process ('bomgar-scc.exe' or 'bomgar-scc') spawns a shell or a common reconnaissance/downloader tool. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2026-1731, where an attacker gains code execution and begins to explore the compromised system.
Hunts for unwarranted hardware additions through USB device connections. In an environment where USB devices are not permitted.
Detects creation of malicious init.d scripts for persistence
To accompany Hunting rule equivalent at
https://detections.ai/rules/019c91c0-b2e0-759d-a61c-78d08e1d3d99
To accompany Hunting rule equivalent at
https://detections.ai/rules/019c91c0-b2e0-759d-a61c-78d08e1d3d99
Identifies the loading of a Linux kernel module from a suspicious, non-standard directory such as /tmp, /dev/shm, /var/tmp, or a user's local hidden directory. Attackers often deploy rootkits and other kernel-level malware from these locations to evade detection and gain persistence. This technique is a prerequisite for kernel-level bypasses like those used by the 'Singularity' rootkit.
Detects successful content injection leading to process execution
Detects the presence or execution of known TeamPCP malware and infrastructure tools (proxy.sh, kube.py, pcpcat.py, and tunneling tools like FRPS/gost) based on their MD5 file hashes. The group uses these standardized payloads to automate their operations.
This detection identifies network connections from non-browser processes to known Large Language Model (LLM) API endpoints. While some connections may be legitimate developer or application traffic, unexpected processes connecting to these services could indicate unauthorized data exfiltration, corporate espionage, or misuse of AI services.
This detection identifies suspicious command-line pipelines commonly used in "ClickFix" attacks. It specifically searches for the use of 'curl' or 'wget' to download a payload that is immediately executed via a shell, often hidden within a subshell `$(...)` or piped directly to an interpreter. This "download and execute" pattern is a high-fidelity indicator of a successful ClickFix lure, where a user has been tricked into running a malicious command.
Hunts for unusual external SSH access patterns indicating Technique T1133
Hunts for unusual external SSH access patterns indicating Technique T1133
This rule detects outbound network connections from Ivanti EPMM appliances to known Out-of-Band (OOB) interaction services and tunneling platforms. This activity is often associated with automated reconnaissance and exploitation verification for vulnerabilities like CVE-2026-1281.
Detects modification of the VSCode settings.json file by a process other than VSCode itself. This could indicate an attempt to exploit vulnerabilities where an attacker tricks a user into applying a malicious configuration to achieve remote code execution.
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
Detects JavaScript-based drive-by compromise execution
Detects activity related to Network Discovery.
Here, one group of network commands has to match for the rule to trigger.
Here, one group of network commands has to match for the rule to trigger.
This rule detects attempts to use outdated or weak cryptographic algorithms and protocols by monitoring command-line arguments of common network and cryptographic utilities. Specifically, it looks for the use of RC4, DES, 3DES, RSA1024, MD5 ciphers, or TLS 1.0, TLS 1.1, and SSL 3.0 protocols, as well as the '--insecure' flag, when executed by applications like openssl, gpg, ssh, or curl. This could indicate an adversary attempting to downgrade cryptographic protections to facilitate eavesdropping or other attacks.
This rule detects the creation of specific JSP web shell filenames (1.jsp, 401.jsp, 403.jsp) and suspicious CSS files in the Ivanti EPMM web application directory. This activity is indicative of post-exploitation persistence following the exploitation of vulnerabilities like CVE-2026-1281 or CVE-2026-1340.
This detection identifies the use of the 'kill' command with a specific, non-standard real-time signal (-59). Rootkits like 'Singularity' use these 'magic' signals as an out-of-band communication channel to trigger actions within a malicious kernel module, such as toggling stealth features or granting root privileges.
Page 294 of 341