Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,144 detections
Filters
Last updated
All Time
Detection languages
3,228
1,086
498
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,979
2,473
1,063
1,026
910
Platforms
39,802
7,144
6,519
3,861
3,601
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,231
1,319
1,319
876
873
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects a suspicious scenario where a non-root process associated with Acronis backup plugins (typically used on cPanel, WHM, or Plesk servers) spawns a child process that executes with root privileges. This behavior is indicative of potential privilege escalation exploiting CVE-2026-87886.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
Detects outbound network connections from internal devices to public IP addresses over standard MQTT (1883) or MQTT over TLS (8883) ports. MQTT is frequently used for IoT communication but can be abused for command and control (C2) or unauthorized data exfiltration.
Detects the initiation of the OAuth 2.0 Device Authorization Grant flow via command-line arguments within standard web browsers. This flow is frequently exploited in phishing campaigns to obtain unauthorized access tokens by tricking users into entering a device code on a malicious or attacker-controlled authorization page.
Detects Node.js processes making outbound network connections to the AWS Instance Metadata Service (IMDS) IP address 169.254.169.254, which may indicate unauthorized data collection or discovery via server-side request forgery (SSRF).
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
Detects the execution of the MeshCentral remote management agent (meshagent.exe) or processes masquerading as the agent using the known alias 'mvtcs.exe'. This rule identifies the start of these processes to detect unauthorized or potentially malicious remote management activity.
Detects suspicious Git activity or file modifications within the plugin directories of various AI coding assistants (such as Claude, Codex, Copilot, or Gemini). This may indicate an attempt to inject malicious code or persistence mechanisms into the local environment via untrusted plugins.
This rule detects processes attempting to interact with the Docker daemon via its Unix domain socket (/var/run/docker.sock). This is a common technique used by attackers to escape from a container, gain host-level control, or execute arbitrary container administration commands.
This rule detects potentially malicious HTTP requests targeting Alibaba Nacos services. It specifically identifies requests that include 'accesstoken' parameters when accessing sensitive endpoints such as user management, login, or configuration modification paths. This pattern is commonly associated with unauthorized attempts to leverage known Nacos vulnerabilities for credential access or configuration manipulation.
Detects the creation of a Git branch where the branch name matches the pattern of a 40-character hexadecimal SHA-1 hash. This behavior is associated with the 'Plugin4Shell' technique, which exploits how some git implementations prioritize matching ref names over target commit objects, enabling an attacker to manipulate or swap code in automated systems or AI coding agents that rely on SHA-pinning.
Detects the creation of a Git branch where the branch name matches the pattern of a 40-character hexadecimal SHA-1 hash. This behavior is associated with the 'Plugin4Shell' technique, which exploits how some git implementations prioritize matching ref names over target commit objects, enabling an attacker to manipulate or swap code in automated systems or AI coding agents that rely on SHA-pinning.
Detects attempts to exploit an unauthenticated Remote Code Execution (RCE) vulnerability in Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing Base64 encoded payloads or direct Python command-line execution patterns, which indicate an attempt to achieve arbitrary code execution.
This rule detects file access events targeting sensitive files such as credential stores, configuration files (e.g., .env, config.yaml, wallet.dat), and AWS credential files. This is indicative of an adversary searching for stored secrets or configuration data to facilitate further lateral movement or privilege escalation. The rule excludes common developer tools like code editors and file explorers to reduce noise.
Detects attempts to exploit a path traversal vulnerability in the GitLab commits API, specifically targeting the /api/v4/projects/ repository/commits path. The rule monitors for directory traversal patterns such as .. or url-encoded variations in conjunction with file paths, which could allow unauthorized access to files outside the intended directory.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects unauthorized attempts to request an AWS token via the JFrog Artifactory API, specifically targeting a vulnerability identified as CVE-2026-42018. The rule triggers when a POST request is made to the '/access/api/v1/aws/token/' endpoint without an Authorization header, indicating potential exploitation of an anonymous token request flaw.
This rule detects potential exploitation attempts against PaperCut servers by identifying high-frequency, consistent-interval network requests directed at PaperCut-specific URI patterns and ports, or associated with known vulnerability identifiers (CVE-2026-81578, CVE-2026-82078). The rule employs statistical analysis to identify potential automated scanning or exploitation activity, filtering out known geographic regions associated with lower-risk or irrelevant traffic.
Detects unauthenticated attempts to exploit CVE-2025-3248 in the Langflow 'validate/code' endpoint, characterized by missing authentication headers and the presence of suspicious Base64-encoded payloads or command execution keywords. Additionally, it identifies potential post-exploitation activity where Langflow processes spawn Python subprocesses.
Page 63 of 341