Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,961
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects when AI-powered development tools or coding assistants (such as Claude, Copilot, Gemini, or Codex) spawn suspicious child processes like command shells (cmd, powershell, bash, sh) or networking utilities (curl, wget, python). This behavior is highly atypical for integrated development environments and may indicate exploitation of the assistant's integration or malicious code execution.
Detects the execution of 'git checkout' commands involving 'FETCH_HEAD', initiated by Gemini or Node.js runtime environments. This pattern may indicate automated repository synchronization, potential software supply chain activity, or anomalous usage of developer tools.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
Detects unauthenticated attempts to exploit CVE-2025-3248 in the Langflow 'validate/code' endpoint, characterized by missing authentication headers and the presence of suspicious Base64-encoded payloads or command execution keywords. Additionally, it identifies potential post-exploitation activity where Langflow processes spawn Python subprocesses.
This rule detects the execution of the MeshAgent remote administration tool from a temporary directory followed by a network connection to known malicious infrastructure within a 15-minute window. This behavior is indicative of unauthorized remote access setup or C2 activity using a legitimate remote management utility.
This rule detects the execution of the MeshAgent remote administration tool from a temporary directory followed by a network connection to known malicious infrastructure within a 15-minute window. This behavior is indicative of unauthorized remote access setup or C2 activity using a legitimate remote management utility.
This rule detects the execution of the MeshAgent remote administration tool from a temporary directory followed by a network connection to known malicious infrastructure within a 15-minute window. This behavior is indicative of unauthorized remote access setup or C2 activity using a legitimate remote management utility.
This rule detects the execution of the MeshAgent remote administration tool from a temporary directory followed by a network connection to known malicious infrastructure within a 15-minute window. This behavior is indicative of unauthorized remote access setup or C2 activity using a legitimate remote management utility.
Detects the execution of the 'fanout.sh' utility from the /tmp directory, which subsequently spawns 'sshpass' child processes to perform rapid, non-interactive SSH authentication attempts ('StrictHostKeyChecking=no') against multiple internal hosts within a 10-minute window. This behavior is indicative of automated lateral movement, specifically observed by threat actor UNC6240.
Detects the execution of the 'fanout.sh' utility from the /tmp directory, which subsequently spawns 'sshpass' child processes to perform rapid, non-interactive SSH authentication attempts ('StrictHostKeyChecking=no') against multiple internal hosts within a 10-minute window. This behavior is indicative of automated lateral movement, specifically observed by threat actor UNC6240.
Detects the execution of the 'fanout.sh' utility from the /tmp directory, which subsequently spawns 'sshpass' child processes to perform rapid, non-interactive SSH authentication attempts ('StrictHostKeyChecking=no') against multiple internal hosts within a 10-minute window. This behavior is indicative of automated lateral movement, specifically observed by threat actor UNC6240.
Detects the presence of the malicious 'indexed-btree' npm package, which contains a backdoor that hooks 'BTree.prototype.set' to execute 'sharedLoad.min.js' at runtime. The rule monitors for characteristic file paths, function hooking patterns, and node process spawning behavior designed to evade installation-time static analysis.
Detects the GHAPPIER loader identified across 65 public npm/GitHub repositories and 22 developer accounts, based on its embedded remote-fetch/eval pattern and campaign markers
This rule detects network connections or DNS requests to domains specifically structured to impersonate MFA registration, passkey setup, or SSO login pages. These domain patterns are commonly associated with phishing campaigns intended to harvest credentials, session tokens, or bypass multi-factor authentication (AiTM phishing).
Detects the 'sharedLoad.min.js' loader script associated with the malicious 'indexed-btree' npm package family. This script utilizes X25519 ECDH for key exchange and AES-256 decryption to retrieve and execute a second-stage payload hosted on a Sepolia smart contract.
Detects Node.js processes executing command lines containing known malicious indicators or accessing specific suspicious JavaScript files (e.g., sharedLoad.min.js) associated with malicious loaders or hardcoded cryptographic keys.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects reconnaissance behavior (System Information, Account, and Network Discovery) performed by processes associated with AI and LLM coding assistants. The rule monitors for a chain of suspicious activities, such as executing discovery commands or excessive network scanning within a 10-minute window, identifying potential misuse of developer-oriented agent tools for post-exploitation reconnaissance.
Detects reconnaissance behavior (System Information, Account, and Network Discovery) performed by processes associated with AI and LLM coding assistants. The rule monitors for a chain of suspicious activities, such as executing discovery commands or excessive network scanning within a 10-minute window, identifying potential misuse of developer-oriented agent tools for post-exploitation reconnaissance.
This rule detects internal network activity (DNS queries, network connections, and security logs) communicating with domains associated with the GhostCode phishing kit. These domains are typically used to host credential harvesting pages or phishing infrastructure.
Page 61 of 347