Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of known Python scripts (CES_Enroll.py, ntlm_ces_relay.py, ces_negotiate_ntlm.py) often associated with NTLM relay attacks or forced authentication techniques. These scripts leverage Python to interact with authentication protocols or relay requests.
The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). This detection identifies suspicious command execution patterns associated with exploitation of this vulnerability, such as executing mesch.exe with specific arguments like b64exec or fullinstall. This activity is indicative of an attacker exploiting CVE-2025-31161 to gain unauthorized access to the CrushFTP server and perform post-exploitation activities.
The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via alternate paths or channels. It leverages Nginx access logs to identify web requests to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected ScreenConnect instance, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
Detects anomalous file access patterns by Semantic Kernel agent processes attempting to read sensitive host files such as SSH keys, configuration files, and credential stores. This activity is indicative of malicious use of agent file-transfer capabilities, potentially exploiting path traversal vulnerabilities or prompt injection to exfiltrate sensitive data from the host environment into the agent sandbox.
Detects anomalous file access patterns by Semantic Kernel agent processes attempting to read sensitive host files such as SSH keys, configuration files, and credential stores. This activity is indicative of malicious use of agent file-transfer capabilities, potentially exploiting path traversal vulnerabilities or prompt injection to exfiltrate sensitive data from the host environment into the agent sandbox.
This rule detects potential backdoor deployment or persistence mechanisms in AI coding assistants like Claude Code and Cursor. It identifies when specific configuration or hook files (e.g., settings.json, hooks.js) are modified, followed within a two-hour window by the execution of suspicious child processes (e.g., powershell.exe, curl.exe, python) initiated by the coding assistant's CLI tool.
Detects instances where package management tools (pip, npm, docker) spawn child processes that immediately attempt to read sensitive files (SSH keys, cloud/container credentials) or perform outbound network connections. This behavior is indicative of a trojanized supply-chain package executing malicious post-install logic to exfiltrate secrets or establish initial communication with a C2 server.
Detects common runtime processes (Node.js, npx, Python) often used for Model Context Protocol (MCP) servers accessing sensitive local credential files such as AWS credentials, SSH private keys, or environment files. This behavior is indicative of potential credential harvesting by unauthorized MCP servers in developer environments.
Detects the presence of prompt-injection framing and malicious intent instructions within the first few lines of source code files. These strings are designed to deceive LLM-based SAST or code review tools into ignoring, misclassifying, or bypassing security analysis of malicious code.
Detects outbound HTTP/HTTPS POST requests where the URI, query string, or path contains evidence of sensitive credential material, such as AWS access keys, private key blocks, or common environment variable patterns, indicative of potential credential harvesting and exfiltration to an external destination.
Detects unauthorized outbound network traffic from browser processes to the lookalike domain 'pdf.gusercontent.com'. This domain is associated with a malicious Firefox browser extension, 'PDF Identity Verifier', which is designed to exfiltrate session telemetry and data from Google account sessions.
Detects CARBONATO botnet activity where malicious processes are masquerading as legitimate Linux system components. This includes XMRig mining software running as /usr/sbin/systemd-logind, process arguments attempting to mimic kernel kworker threads, or processes running from directories associated with netd-svc/resolved container images.
Detects evidence of persistence mechanisms targeting Docker environments on Linux systems. The rule identifies suspicious modifications using crontab, systemctl (service creation/start), and chattr (to make files immutable), specifically monitoring for artifacts related to '.docker-network-monitor' and 'docker-network-resolver'. It flags systems where multiple such configuration changes occur within a single day.
Detects an endpoint initiating outbound network connections to three or more distinct LLM provider APIs (DeepSeek, Qwen, Mistral, Gemini) within a short timeframe (15-minute windows). This behavior aligns with the multi-provider voting mechanism used by the CLOSEDQUORUM post-compromise framework to autonomously determine subsequent actions using diverse generative AI models.
Detects malicious interactions with an unauthenticated Docker daemon API, specifically identifying the creation of privileged containers with host bind mounts, the deployment of containers with specific naming conventions for network reconnaissance (netns-probe/net-setup), subsequent container start events, and the use of the Docker exec API to perform host namespace escapes via nsenter.
Detects the execution of the CARBONATO malware watchdog process (.docker-network-monitor) which performs container redeployment operations, indicating an active backdoor and persistent threat attempting to restore its presence within a Docker environment after initial cleanup.
Detects a suspected automated exploitation sequence where a web storefront file (e.g., .phtml, .js, .php) is modified to inject malicious script code (skimmer), followed by an unauthorized SQL DELETE operation on sensitive database tables containing payment, customer, or order information, originating from the same host within a 6-hour window.
Detects evidence of the CARBONATO post-exploitation pattern, specifically identifying the installation of a Hermes Agent by monitoring the creation of a 'SOUL.md' persona file within a '.hermes' folder, followed by correlated outbound network traffic to a specific LLM gateway or known Vercel proxy infrastructure used for command relay.
Detects anomalous activity associated with the CARBONATO worm, specifically monitoring for unauthorized creation of 'net-setup' containers or pulling 'system/resolved' images via the Docker API port 2375. Additionally, the rule identifies rapid, sequential network scanning behavior targeting the Docker API port across internal IP ranges.
Detects unauthorized access attempts to a Docker Registry API on port 5000. The rule identifies attempts to enumerate the image catalog and extract sensitive environment variable information from configuration blobs, which may contain hardcoded credentials or indicators of compromise.
Detects outbound connections to a known malicious C2 infrastructure associated with the CARBONATO threat actor. The rule identifies both established SSH sessions using the OpenSSH implementation and the initiation of outbound TCP connections on ports dynamically determined by an MD5 hash, which is a known behavior of this actor's C2 communication strategy.
Page 40 of 340