Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects the execution of tooling routed through a reverse SOCKS5 pivot via wrappers such as via_socks.sh, proxychains4 with a SOCKS5 configuration, or LD_PRELOAD injection of libproxychains.so.
Detects when a Java or JavaW process spawns a Unix shell (bash, sh, dash) with command-line arguments indicative of a reverse shell utilizing /dev/tcp and interactive shell flags.
Detects a sequence where a Codex agent process executes a shell or command interpreter, followed by logging or monitoring tampering activity on the same device within a 30-minute window.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects PHP memory exhaustion errors ('Allowed memory size exhausted') logged via syslog, which may indicate resource exhaustion, denial of service attempts, or exploitation attempts against PHP-based web applications.
Detects instances where the Apache web server spawns a shell process (sh, dash, bash) which subsequently executes common discovery or callback utilities (such as id, curl, wget, php, hostname, or uname), typically indicative of web application exploitation or remote code execution.
Detects outbound IPv4 and IPv6 connections from endpoints to public IP addresses on high-numbered ports (1023 and above), excluding private, reserved IP ranges and known noisy processes. Command-and-control tools, malware and tunneling activities may use uncommon ports to evade network monitoring.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Detects a suspicious sequence where a client IP performs a brute-force attack against WordPress login or XML-RPC endpoints followed by enumeration of the wp-json REST API.
Detects web server processes (such as apache2, httpd, nginx, php-fpm) spawning a shell or curl process that performs LDAP queries using curl against URLs. This activity is indicative of Remote Code Execution (RCE) vulnerabilities being exploited against web applications to perform internal reconnaissance or LDAP enumeration.
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects the deployment of the ARTEX AI penetration testing framework via Docker/Docker-compose combined with the execution of offensive security and scanning tools (such as nmap, sqlmap, nuclei, httpx, apktool, frida) on the same host within a specified timeframe.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects outdated or vulnerable installations of GitLab and Ruby across devices using TVM software inventory, software vulnerabilities, process events, and file events, checking against known fixed versions for specific CVEs.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Detects network connections to the npm registry (registry.npmjs.org) initiated by AI coding agent processes (such as Claude, Cursor, Copilot, Windsurf, Codeium, Aider) or by unexpected processes that are not standard package managers or browsers.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Page 4 of 347