Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects instances where AI-assisted development tools (such as Claude, Codex, Copilot, or Gemini) initiate command-line processes (e.g., shells, interpreters, or network utilities) with arguments indicative of credential access, reconnaissance, or sensitive file interactions.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
This rule monitors for interactions with known malicious files (by SHA256 hash), connections to confirmed C2 infrastructure (specific IP address and domains), or requests to known malicious URLs. It aggregates indicators across file, process, network, and web browsing telemetry to identify potential threats or compromised systems communicating with known attacker infrastructure.
TokenGrabber Builder: Webhook XOR/Base64 Obfuscation Artifacts - detects webhook.txt persistence, XOR 0x5A + Base64 webhook obfuscation, WEBHOOK_PLACEHOLDER injection, and the _x() decode routine used to recover the exfiltration endpoint
Detects potential exploitation of CVE-2026-41940 affecting cPanel/WHM, where administrative actions occur without a preceding successful login event from the same source IP within a 30-minute window. This indicates an authentication bypass attempt.
This rule detects command-line activity where a remote resource is downloaded via 'curl', decoded using 'base64', and then piped directly into a shell interpreter (sh, bash, or zsh). This pattern is commonly used in fileless execution or stage-one payload delivery by attackers to execute malicious scripts directly from memory.
Detects execution of the Go runtime invoking a local module ('go run .') initiated by infrastructure-as-code tools like Terraform or standard command-line interpreters. This pattern matches the behavior of the Graphalgo RAT, which uses a hash-gated mechanism within malicious modules to trigger a second-stage payload.
Detects anomalous outbound network connections initiated by security and developer tooling (Trivy, Checkmarx, LiteLLM, Telnyx). This behavior is consistent with supply-chain attacks, such as those attributed to the UNC6780/TeamPCP threat group, where compromised tooling is leveraged to exfiltrate sensitive cloud credentials or API keys to external, non-vendor infrastructure.
Detects anomalous, rapid execution of a high volume of diverse offensive security tools (scanners, exploitation frameworks, and C2 agents) from a single parent process within a short window, which is characteristic of automated LLM-driven orchestration or scripted attack tool chaining.
Detects outbound HTTPS connections to major generative AI inference endpoints originating from non-browser, non-development tool processes at regular intervals. This activity is indicative of beaconing behavior, where malware (specifically families like LAMEHUG) leverages LLM APIs for dynamic command generation, payload obfuscation, or C2 instruction retrieval, bypassing traditional security controls.
Detects endpoint behavior consistent with AI-assisted exploit development, characterized by the execution of reverse engineering and vulnerability research tools (e.g., IDA Pro, Ghidra, AFL) interleaved with frequent outbound network connections to LLM APIs, followed by the local compilation of a new executable or DLL.
Page 56 of 347