Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
116
41
34
33
20
Contributors
106
38
28
23
20
Categories
165
157
111
46
39
Platforms
229
188
103
9
9
Products / Services
10,650
9,755
6,688
4,418
3,745
295
MITRE Techniques
172
112
60
51
43
CVEs
6
6
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects the execution of Python-based proof-of-concept scripts related to the Pillow ImageCms out-of-bounds write vulnerability. The rule monitors for Python process execution involving specific file paths associated with the PoC, and correlates this with subsequent process crashes or abort signals which are indicative of an exploit attempt resulting in process instability.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects suspicious network activity from common scripting and runtime environments (Python, Node.js) that communicate with known blockchain-related infrastructure (e.g., Tron, Aptos). The rule flags processes that establish connections to multiple distinct external IP addresses while querying these specific domains, which may indicate cryptocurrency mining, wallet-stealing malware, or unauthorized distributed computing activity.
Detects exploitation attempts against Langflow targeting unauthenticated API endpoints (/api/v1/build_public_tmp or /run) for remote code execution, as well as downstream process spawning activity on Linux hosts where Python processes execute shell commands (e.g., curl/wget piping to sh) to download known malicious dropper payloads.
Detects the execution of Python scripts that include libraries (pynput, pyxhook) or functions (GetAsyncKeyState, WH_KEYBOARD_LL) frequently used by keyloggers to capture user keystrokes. It also monitors for suspicious input device access and command-line arguments indicative of keystroke monitoring.
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
Detects the execution of the libpwn_cve_2026_55200_server.py Python script, which is identified as a malicious SSH scaffold targeting CVE-2026-55200. This script facilitates exploitation of libssh2 clients by binding to a specific port and delivering malformed packets during the pre-authentication phase.
Detects exploitation attempts against the Flowise MCP environment variable case-sensitivity vulnerability. Attackers can leverage a lowercase 'node_options' environment variable on Windows to bypass Flowise security denylists, allowing the injection of arbitrary JavaScript via the Node.js --require flag. The rule also monitors for the execution of associated proof-of-concept (PoC) python scripts and markers.
Detects the execution of Python interpreters or scripts involving keylogging-related libraries (pynput, pyxhook, pywin32, keyboard) or direct access to Linux input devices (/dev/input/event*), correlated with the creation of temporary script files, which is a common pattern for Python-based keyloggers.
Detects Python scripts with reverse shell socket connection patterns
This rule monitors for process creations spawned by common web application servers (e.g., nginx, python, java, php) where the command line arguments contain indicators of a Server-Side Request Forgery (SSRF) attempt. Specifically, it looks for suspicious URL schemes (file:, gopher:, dict:, ftp:), potential authority confusion patterns (targeting cloud metadata IPs), and encoded directory traversal characters when paired with sensitive paths like 'etc' or 'proc'.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
This rule monitors for potential Server-Side Template Injection (SSTI) exploitation by detecting web application processes (such as Java, Python, or Web Server binaries) that initiate child processes (such as shell interpreters or script engines) while their command line contains common SSTI markers or exploitation patterns like '{{7*7}}', 'subprocess.Popen', or 'java.lang.Runtime'. This indicates an attacker has successfully escalated from template injection to remote code execution.
Detects the execution of specific Python scripts associated with the FortiBleed campaign. These scripts include 'spray_da.py' for domain admin password spraying, 'smb_test.py' for SMB validation and lateral movement, 'spider.py' for Active Directory crawling, and 'ad_full_audit.py' for Active Directory auditing. Detection is based on the Python interpreter executing these specific script filenames.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
This rule detects scenarios where development tools such as VS Code (Code.exe) or npm spawn multiple child processes of Python or Node.js interpreters within a short time window, followed by those same interpreters accessing sensitive credential files (e.g., SSH keys, browser login data, or cloud configuration files). This pattern is indicative of a developer workstation compromise or a supply chain attack involving malicious code execution.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
Detects post-exploitation of CVE-2026-22778 (vLLM libopenjp2 JPEG2000 cdef heap overflow). The overwritten AVBuffer free() pointer is set to system(), so a successful exploit spawns /bin/sh -c as a direct child of the vLLM/python inference process. Matches a shell or download/exec utility launched with a vLLM/python/uvicorn parent, excluding benign python worker children.
Page 6 of 15