Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
116
41
34
33
20
Contributors
106
38
28
23
20
Categories
165
157
111
46
39
Platforms
229
188
103
9
9
Products / Services
10,650
9,755
6,688
4,418
3,745
295
MITRE Techniques
172
112
60
51
43
CVEs
6
6
3
2
2
IDS Classtypes
4
IDS Protocols
4
This rule detects authentication attempts to the 'Device Registration Service' in Entra ID where the User-Agent string contains 'python'. This is often indicative of automated scripts, such as those using libraries like msal, being used to interact with device management APIs, which may be associated with legitimate automation or adversary activity.
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
This rule detects potentially unauthorized database manipulation of the 'xadmin' platform, including suspicious administrative role modifications and deletions. It also monitors for suspicious Python script execution involving the 'bcrypt' library, which can be used to generate or verify password hashes in potentially malicious scripts.
This rule detects the use of database-related processes (mysql) or scripts (python) interacting with MySQL User-Defined Function (UDF) mechanisms. Attackers often abuse UDFs to execute arbitrary commands, load external libraries, or facilitate lateral movement/privilege escalation within a database environment.
This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.
This rule monitors for the execution of the 'pg_dump' utility by Python-based applications (like Langflow), followed by the deletion of a file on the same host within 60 minutes. This behavior may indicate an adversary staging data, dumping a database, and then attempting to remove evidence of the activity.
This rule detects Python processes initiated or executed in association with 'langflow'. It flags instances where Python is invoked with command-line arguments containing Base64 decoding patterns or '-c' flags, which are commonly used by attackers to execute obfuscated or staged payloads within a Python environment.
This rule detects the execution of Python or MySQL command-line utilities where the command line contains strings indicative of 'mysql.func'. This pattern is often associated with the loading of malicious UDFs (User Defined Functions) or other exploitation techniques targeting database environments through script interpreters.
Detects the execution of Python processes via the command line that include both the '-c' flag for executing inline code and specific code patterns related to network data retrieval ('urllib.request.urlopen') or decoding obfuscated data ('base64.b64decode'). This behavior is commonly used by adversaries to download and execute secondary payloads or handle C2 communication.
This rule detects the execution of Python (pip) or Node.js (npm) package managers with command-line arguments specifying alternative package repositories (e.g., --index-url, --registry) that do not belong to the standard, trusted public repositories (pypi.org or npmjs.com/npmjs.org). This behavior is often indicative of supply chain attacks, where attackers attempt to trick users or automated systems into installing malicious dependencies from compromised or attacker-controlled repositories.
Detects the execution of known exploit harnesses and proof-of-concept scripts related to CVE-2026-55200, a critical pre-authentication heap out-of-bounds write vulnerability in libssh2. The rule monitors for the execution of binaries and Python scripts identified as part of the libpwn exploit toolkit used to trigger the vulnerability.
Detects post-compromise persistence techniques, including crontab modifications, SSH authorized_keys updates, and systemd service creation, when performed by child processes of AI agentic tools like Claude, Node.js, or Python. This activity suggests malicious persistence establishment following an indirect prompt injection or supply-chain compromise of the AI agent environment.
Detects MCP (Model Context Protocol) server processes or developer tools spawned by IDE extensions performing environment variable enumeration to access cloud credentials (e.g., AWS, Azure, GCP, GitHub tokens) followed by anomalous outbound network connections, indicating potential exfiltration of sensitive developer environment secrets.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
Detects instances where a Python interpreter (python.exe or python3.exe) initiates an interactive command-line shell (cmd.exe, powershell.exe, bash.exe, or sh.exe). The detection logic further narrows this behavior by looking for common reverse shell indicators such as socket connections or command execution arguments within the process command line.
Detects instances where a Python interpreter (python.exe or python3.exe) initiates an interactive command-line shell (cmd.exe, powershell.exe, bash.exe, or sh.exe). The detection logic further narrows this behavior by looking for common reverse shell indicators such as socket connections or command execution arguments within the process command line.
Detects the execution of known MyBB 'Limited ACP to Admin' proof-of-concept scripts via common python interpreters and identifies suspicious child process spawning behavior from typical web server applications (such as nginx, apache2, and php-fpm). This activity is indicative of post-exploitation attempts or web shell execution via injected plugins or templates.
Detects the spawning of a Python interpreter process by npm or node.js parent processes where the Python command line involves directories typically used for temporary files or staging (e.g., AppData, Temp). This behavior is consistent with the execution of the InvisibleFerret multi-stage backdoor, often delivered via malicious packages in developer environments.
Detects potential remote code execution (RCE) attempts targeting Langflow that manifest as the spawning of child shell processes or the execution of curl/wget commands to download and execute malicious scripts (specifically 'isp.sh') from the IP address 83.142.209.214. It also monitors for Python-based execution patterns using 'os.system' to drop or execute these payloads.
This rule detects potential exploitation of an out-of-bounds write vulnerability in Python's Pillow library (ImageCms module). It identifies Python processes initialized with indicators related to known exploit research (exploitarium) that subsequently terminate with error signals indicative of a crash, such as heap-buffer-overflows or memory management errors, suggesting successful or attempted exploitation.
Page 5 of 15