Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects a specific command and control (C2) communication pattern characteristic of RatHat malware, involving the retrieval of HTML overlay templates followed by the submission of captured form or credential data from the same device within a one-hour window.
Detects unauthorized file creation within the /root/.hermes/loot/ directory and specific path combinations associated with the CARBONATO botnet's Hermes Agent. This activity is indicative of credential harvesting, specifically the exfiltration of AI API keys for various LLM providers.
Detects the execution of the XMRig cryptominer masquerading as the legitimate systemd-logind service. The rule identifies suspicious command-line arguments indicative of mining activity, or instances where systemd-logind is spawned from unauthorized parent processes such as shell interpreters, container engines, or nsenter, which is often characteristic of post-exploitation activity like privileged Docker container escapes.
Detects the CARBONATO botnet using two distinct persistence and evasion techniques: masquerading user-space processes as kernel worker threads by setting command line arguments to '[kworker/u2:0]', or disguising mining binaries as the systemd-logind service. Legitimate kernel threads are spawned by PID 2 and lack an executable path, while the legitimate systemd-logind is expected to be spawned by systemd/init.
Detects the presence of known RatHat Go-based command agents (liblocal-service.so) or frpc reverse-proxy clients (libmedia_codec.so) when staged within temporary directories such as /data/local/tmp on Android devices, often following manual ADB shell interaction.
This rule detects Terraform CLI execution of the 'init' command correlated with network access to HashiCorp AWS registry domains, or the presence of Terraform lock files in specific sensitive or project-related directory paths. This combination often indicates infrastructure-as-code management activities or potential misuse of Terraform in a production environment.
Detects the use of package installation commands (pip, npm, npx) where the package name resembles popular AI/ML libraries (tensorflow, torch, openai, langchain) but is not an exact match for known legitimate versions. This is a common indicator of a typosquatting supply chain attack, where attackers attempt to trick users into installing malicious packages with similar names to trusted software.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects a network activity pattern from a single host characterized by a high volume of connections to a wide range of remote hosts and ports, combined with an exceptionally low coefficient of variation in inter-request timing. This pattern is indicative of an automated, scriptable agent or AI-driven reconnaissance tool rather than a human-operated scanner, likely performing automated asset discovery or network enumeration.
Detects network connections from server or workload identities (excluding SYSTEM) to known public Generative-AI inference API domains. This may indicate the use of AI services for data exfiltration, automated content generation, or C2 communication via legitimate web services.
Detects the use of command-line tools such as rclone, aws CLI, gsutil, and curl to upload files associated with machine learning models (e.g., weights, checkpoints, training datasets) to public cloud storage or AI model hosting platforms. This pattern may indicate the exfiltration of sensitive proprietary AI research or training data.
Detects a single source IP address rapidly attempting connections to multiple distinct devices and ports within a short time window. This behavior is indicative of an automated agent or scanner performing reconnaissance and potentially attempting to chain exploitation across multiple targets.
Detects web reconnaissance activity characterized by the use of User-Agent strings associated with automated AI agent frameworks and headless browser libraries (e.g., LangChain, AutoGPT, Playwright, Selenium, python-requests). These tools are frequently utilized in autonomous exploitation scenarios to scan multiple URI paths on a web server in a short timeframe.
Detects the presence of known AnonyMousKIT Phishing-as-a-Service (PhaaS) shared components (legacy.js, Core.js, ToolsController.php) by matching specific file hashes or detecting these filenames in small files. This rule is designed to identify backend infrastructure used by phishing resellers.
Detects the execution of shell interpreters (PowerShell, CMD, Bash, Zsh) with suspicious command-line arguments typically associated with malicious activity, such as encoded commands, hidden window styles, or network download requests, when initiated by common user-facing applications like web browsers or Windows Explorer.
Detects a multi-stage attack chain involving the download, extraction, permission modification, and execution of the XMRig cryptocurrency miner on Linux systems. The rule specifically monitors for common staging patterns in /tmp and the use of known mining-related CLI arguments.
Detects a post-compromise pattern on a WordPress site where an attacker, after an initial login, rapidly accesses multiple sensitive administrative pages (plugins.php, profile.php, etc.) within a short window, suggesting nonce harvesting. This activity is correlated with the subsequent creation of a suspected webshell file named 's.php'.
This rule monitors for potential privilege escalation activity occurring shortly after an initial authentication event. It includes two primary vectors: 1) Azure AD users assigned to highly privileged roles shortly after a successful sign-in; 2) Users performing interactive or remote logons to Linux/Unix systems followed quickly by sudo or su commands to obtain root privileges.
Detects execution of remote payloads by piping the output of network utilities like curl or wget directly into a shell interpreter (bash, sh, zsh). This pattern is a common technique used by attackers to execute malicious scripts directly from a remote server without saving a file to disk.
Detects network activity associated with the JWR/Outsider phishing kit, which leverages legitimate e-commerce platform parameters (e.g., Shopify/WooCommerce 'cart_data') to mimic storefront infrastructure. The rule correlates requests containing these e-commerce parameters with the loading of the phishing kit's client-side engine scripts or WebSocket workers from the same host, indicating the use of a compromised or malicious storefront-mimicry domain.
Page 41 of 340