Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,214
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,781
7,128
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
Detects modifications to the Tor configuration file (torrc) that permit SSH traffic (port 22) in the exit policy, followed by a Tor service reload or restart on the same device within a 4-hour window. This behavior may indicate an adversary setting up an onion routing proxy or covert tunnel.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects the deployment or creation of containers (via Docker, Podman, Nerdctl, Crictl, or Kubectl) with elevated risk flags such as privileged mode, host namespace sharing, root mounts, docker socket access, or initiated from web application parent processes.
Detects HTTP requests to the PeopleSoft PSEMHUB servlet using alternate
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects a PHP file being written into a WordPress content directory
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
Detects process execution and network connection events associated with SysGoRAT or CL-UNK-1211, identifying known indicators of compromise including specific process names, command-line usage, C2 IP addresses, and malicious domains.
Detects network connections and traffic matching known Midnight Blizzard (APT29) IOC Internet Protocol addresses and paths using Microsoft Defender for Endpoint and Common Security Log data.
Detects potential web shell installation or PHP configuration tampering in web roots by identifying known web shell hashes, PHP configuration modifications containing auto_prepend_file or auto_append_file directives outside of root, or PHP file creation/modification by web server processes.
Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.
Detects GitLab backend processes (such as puma, sidekiq, rails, ruby, bundle) spawning shells, scripting interpreters, or network tools with suspicious command-line parameters, potentially indicating post-exploitation activity or vulnerability exploitation.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Page 3 of 340