Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects the presence of the 'SOUL.md' configuration file associated with the Hermes Agent AI framework. This file contains a specific 'GH0ST' persona prompt designed to bypass ethical restrictions (jailbreak) and configure the agent for automated post-exploitation tasks, such as loot collection and Telegram-based command and control.
Detects the creation of files containing AI provider API keys within the /root/.hermes/loot/ directory, consistent with credential harvesting behavior observed by the CARBONATO GH0ST agent.
Detects the deployment of the CARBONATO botnet's Hermes Agent within containerized environments. The rule identifies specific artifacts such as the 'SOUL.md' persona configuration, 'netd-svc' container references, and indicators of AI-focused credential theft (e.g., searching for OpenAI or Anthropic API keys) orchestrated by the GH0ST AI agent.
Detects the deployment and operational artifacts associated with the Hermes Agent framework using the CARBONATO GH0ST persona on Linux systems. This detection focuses on identifying specific file-system indicators, including persona configuration files (SOUL.md), loot staging directories, and deployment entry scripts (entry.sh or CARBONATO_API_KEY artifacts) that indicate malicious activity and potential AI-driven Telegram command and control (C2) staging.
Detects the use of the 'getevent' utility on Android/Linux systems to monitor and capture raw input events from '/dev/input'. This technique is often used by mobile malware to perform keylogging by intercepting touch or physical keystroke event streams, bypassing standard application-level input handling.
This rule detects potentially malicious activity on Android devices where the 'shell' user is performing silent application installations using 'pm install' and subsequently granting accessibility permissions via 'settings put secure'. This sequence is indicative of malware attempting to gain elevated control over the device by bypassing user-interactive prompts for installation and permission authorization.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects unauthorized or suspicious configuration changes on Cisco IOS XR devices, specifically targeting the creation of SPAN/mirroring sessions, ACL modifications to bypass traffic filtering, and changes to AAA or local user authentication settings. These patterns are consistent with post-compromise activities by adversaries seeking persistence and traffic interception.
Detects the creation of an administrative-level user account (e.g., 'ops') on a MikroTik RouterOS device shortly after an anomalous login attempt using the '-2' username. This sequence is indicative of the exploit chain associated with specific MikroTik RouterOS vulnerabilities where an unauthenticated or specially crafted login is used to facilitate unauthorized user creation.
Detects attempts to modify the Redis configuration (dir or dbfilename) followed by a SAVE command, which can be leveraged to write arbitrary data to critical system files such as crontabs for persistence.
Detects unauthorized changes to network appliance configurations, specifically the installation of new software packages using opkg or the modification of network address translation (NAT) rules via iptables or nftables. These actions can be used to maintain persistent access or establish covert command and control infrastructure.
This rule detects artifacts and behaviors associated with the WaterPlum/Contagious Interview (also known as DeceptiveDevelopment) malware suite, including BeaverTail, InvisibleFerret, and related payloads. The rule specifically targets the presence of embedded family-name strings, as well as the execution of suspicious npm package installations triggered by VS Code task automation (tasks.json) or trust prompts, common in fake technical interview attack scenarios.
The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
Detects malicious BASH_ENV injection within GitHub Actions CI pipelines originating from the compromised sckit_poetry_build.py build backend. The injection, which targets GITHUB_ENV to introduce a malicious _pypi_bridge.sh script, is used to intercept PyPI publishing tokens during build processes, characteristic of the MemTensor/sckit supply chain attack.
Detects the creation of a malicious GitHub Actions workflow file named 'runtime-update.yml', a known tactic used by the Sckit supply-chain worm. The worm injects this workflow to automate persistence and further propagation of the Go-based implant within CI/CD pipelines.
Detects the creation of a 'ca-roots.pem' file within a hidden '.sckit' directory on Linux systems. This behavior is associated with the 'sckit' supply-chain malware (e.g., delivered via malicious npm packages like @memtensor/memos-cloud-openclaw-plugin), which uses this bundled certificate to enable HTTPS Command and Control (C2) communication in environments where standard system CA stores are unavailable.
Detects the installation of AI-related packages (e.g., mcp, tiktoken_mcp) via common package managers (pip, npm, docker) followed by an outbound network connection from the same host within 10 minutes. This behavior is consistent with supply chain attacks where trojanized AI/MCP components are used to initiate command-and-control communication shortly after deployment.
Detects the creation of a new local user account named 'ops' or an account with 'full' group privileges on MikroTik RouterOS. This rule is designed to identify potential persistence mechanisms following the exploitation of MikroTrick vulnerabilities (CVE-2026-67279/CVE-2026-86060), often indicated by anomalous prior login patterns.
Detects malicious bash scripts identified as part of the BYOB C2 framework infrastructure. These scripts are designed to download and install second-stage payloads such as Meterpreter or XMRig-style cryptominers. The rule identifies these scripts by their specific naming conventions, embedded C2 infrastructure indicators, and persistence mechanisms including crontab, systemd, and rc.local.
Detects execution of remote payloads by piping the output of network utilities like curl or wget directly into a shell interpreter (bash, sh, zsh). This pattern is a common technique used by attackers to execute malicious scripts directly from a remote server without saving a file to disk.
Page 6 of 51