Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects instances where common scripting or development language runtimes (Go, Node.js, WScript, CScript) access sensitive configuration or credential files, such as AWS credentials, Kubernetes configs, SSH keys, or environment files. This activity is often indicative of credential harvesting or unauthorized access to sensitive secrets by potentially malicious scripts or processes.
Detects evidence of an argument-injection attack against MikroTik RouterOS (CVE-2026-86060), where the attacker provides the literal username '-2' during the login process. This action allows the attacker to bypass standard credential validation by exploiting a forged privilege mask. This is typically observed in conjunction with unauthorized access attempts following CVE-2026-67279.
Detects 'unshare' creating a user/mount/net namespace by a non-root user, outside
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
Detects creation or modification of files under /etc/sudoers or /etc/sudoers.d/ by a
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
Detects anomalous child processes, such as shells or interpreters, spawned by web server processes (PHP-FPM, Apache, Nginx). This behavior is often indicative of exploitation attempts, such as Remote Code Execution (RCE) via web application vulnerabilities.
Detects autonomous behavior where AI-driven processes attempt multiple network connections (SMB, SSH, HTTP, RDP, WinRM) to diverse targets following failed access attempts. The rule correlates initial failure activity with subsequent credential-related events and new lateral movement traffic from the same agent process within a short window, suggesting adaptive adversary pivoting.
This rule detects attempts to exploit a pre-authentication path traversal and unsafe file-upload vulnerability (CVE-2026-93616) in Check Point Management Server. It monitors web server logs for specific application-level error messages related to ReflectionUtils failure and suspicious path traversal sequences (../) in request URLs.
Detects instances where the 'curl' utility is used to download files while simultaneously piping the output directly into a shell interpreter (bash/sh) or using download flags ('-o', '-O') in a way that suggests staging or immediate execution of remote scripts, often associated with force-flag bypass patterns.
Detects the download of a dataset from an unapproved source that lacks hash verification, followed shortly by the launch of a model training process on the same host. This behavior is indicative of potential supply chain compromise or poisoning of the training data used in machine learning workflows.
Detects unauthorized or anomalous modifications to machine learning model checkpoints. The rule triggers on significant deviations in weight delta percentages outside of scheduled fine-tuning windows, or when a model checkpoint hash is altered by users or service accounts without corresponding CI/CD pipeline approval or documented code review.
Detects the execution of suspicious child processes (e.g., cmd.exe, powershell.exe, bash, wget) spawned by processes associated with public-facing appliances like Fortinet SSL-VPN, Veeam Backup & Replication, Citrix ADC, and cPanel/WHM. This behavior is often indicative of exploitation of public-facing applications (T1190) for initial access, frequently associated with ransomware actors targeting unpatched infrastructure.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
This rule detects network connections from internal devices to a specific remote IP address (134.122.155.135) over port 443. This is characteristic of communication with a known or suspicious Command and Control (C2) server.
IOC hunt across DNS, network, and file-hash telemetry for the Ledger Google Ads phishing campaign. Vercel redirect domains are matched by exact hostname (DNS query name / parsed URL host) rather than substring, eliminating false positives from unrelated strings that merely contain a look-alike domain fragment. GCS bucket and Google Sites path IOCs remain substring-matched since the bucket IDs and page slugs are already highly specific.
This rule detects the execution of the MeshAgent remote administration tool from a temporary directory followed by a network connection to known malicious infrastructure within a 15-minute window. This behavior is indicative of unauthorized remote access setup or C2 activity using a legitimate remote management utility.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects anomalous outbound network connections initiated by security and developer tooling (Trivy, Checkmarx, LiteLLM, Telnyx). This behavior is consistent with supply-chain attacks, such as those attributed to the UNC6780/TeamPCP threat group, where compromised tooling is leveraged to exfiltrate sensitive cloud credentials or API keys to external, non-vendor infrastructure.
Detects high-volume SSH authentication failures from a single source IP address within a short time frame, which is indicative of credential spraying or brute force activity.
Detects unauthenticated HTTP requests directed at management or schema APIs for common vector databases (Milvus, Weaviate, Qdrant). These requests lack the required Authorization header, potentially indicating unauthorized reconnaissance or attempts to exploit public-facing database management interfaces.
This rule detects attempts to exploit a command injection vulnerability (CVE-2026-49869) in the Kestra workflow automation platform. The rule monitors HTTP POST requests to the '/api/v1/flows' endpoint, identifying payloads that define flow types involving shell or execution plugins and contain suspicious command sequences (e.g., shell operators combined with common system utilities like nc, bash, or curl).
Page 31 of 347