Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.
Detects the PeerBlight Linux backdoor masquerading as the '[ksoftirqd]' kernel thread. This is a defense evasion technique used by the malware to blend in with legitimate system processes.
Behavior is tied to enumeration of network services, relating to the discovery tactic.
Where "network_connection_discovery`"is a lookup table of “ifconfig.me” and related services
Where "network_connection_discovery`"is a lookup table of “ifconfig.me” and related services
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects DNS Command and Control (C2) activity associated with the Linux/BPFDoor malware. It specifically looks for DNS queries containing a magic value "X:" followed by a dot "." at the beginning of the query, indicating a potential C2 communication channel used by BPFDoor. The rule also includes a byte test to ensure the query length is greater than 20 bytes and a threshold to limit alerts to 3 occurrences within 300 seconds from the same source.
Detects installed Next.js versions < 16.0.7 vulnerable to CVE-2025-55182 (React Flight RCE)
Detects the spawning of a shell process from a Node.js or Next.js server process, which is a strong indicator of post-exploitation activity following a Remote Code Execution (RCE) vulnerability like CVE-2025-55182 or CVE-2025-66478.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects network connections to or DNS requests for known malicious IP addresses and domains associated with phishing campaigns. The domains often mimic legitimate services like Zoom, Microsoft, and Google, indicating potential credential harvesting or malware distribution attempts.
Detects the installation of specific NPM packages that have been identified as compromised by the Shai-Hulud "Second Coming" worm. Installation of these packages can lead to credential theft and further propagation of the malware.
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
Detects the creation of a persistent GitHub self-hosted runner named 'SHA1HULUD', a technique used by the Shai-Hulud 2.0 malware for persistence and remote command execution. The rule specifically looks for process command lines containing " --name SHA1HULUD".
Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.
Detects a process executing from a temporary directory that masquerades as the legitimate 'systemd-logind' service. This behavior is characteristic of the V3G4 Mirai-derived botnet, which uses this technique to evade detection.
Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.
Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.
Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.
Detects the creation of a project-local OpenAI Codex configuration file (`.codex/config.toml`) followed by the execution of the `codex` CLI from the same directory. This pattern is indicative of an attempt to exploit CVE-2025-61260, a command injection vulnerability that allows for arbitrary code execution.
This query identifies an anomalous pattern associated with behavior performed by Sha1-Hulud to perform initial access, connect to C2, and establish persistence. Ref: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
This rule detects the creation or modification of a GitHub Actions workflow file named 'discussion.yaml' within the '.github/workflows/' directory. This is a known persistence technique used by the Shai-Hulud 2.0 worm to register an infected machine as a self-hosted runner, allowing attackers to execute arbitrary commands.
Page 302 of 341