Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,214
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,781
7,128
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the launch of bad-bpf style eBPF rootkit loaders (pidhide with --pid-to-hide, sudoadd with --username) executed via sudo or from an interactive shell parent, representing the userspace step that issues bpf(BPF_PROG_LOAD) before tracepoint hooks go live.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects an npm or pip package installation process spawning a script
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
Detects the AnyDesk Linux service running as root spawning a shell process (sh, bash, dash, zsh) or executing a command associated with the AnyPwn (CVE-2025-27918) post-exploitation behavior.
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects instances where package managers (pacman, makepkg, yay, paru) or their children spawn a root shell that downloads and executes external scripts via curl or wget.
Detects modification of core Ivanti Connect Secure system files on the
appliance. Attackers patch shared libraries and Perl modules such as
/home/lib/libdsplibs.so and /home/perl/DSUpgrade.pm to install an implant that is
loaded by legitimate services, blending malicious code into normal appliance
operation and surviving reboots.
appliance. Attackers patch shared libraries and Perl modules such as
/home/lib/libdsplibs.so and /home/perl/DSUpgrade.pm to install an implant that is
loaded by legitimate services, blending malicious code into normal appliance
operation and surviving reboots.
Detects the usage of command-line flags in AI coding assistant CLIs (such as Claude Code, Amazon Q CLI, and others) that intentionally skip security permissions, bypass approvals, or disable sandbox protections. The rule identifies potential developer activity that may inadvertently reduce the security posture of the development environment.
Sweeps DNS, endpoint network and proxy/firewall telemetry for BraZetsu C2, panel and shop domains using exact or subdomain matching. The apex installscenter.com remains active on Cloudflare with wildcard certificates.
Summarizes the count of devices grouped by their manufacturer and model from device inventory or telemetry data.
Summarizes the count of devices by CPU manufacturer and architecture using Kusto Query Language (KQL).
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Page 4 of 340