Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,961
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
This rule detects the execution of npm or node.js commands involving specific, potentially malicious package names or internal project naming patterns often associated with dependency confusion or supply chain attacks. It monitors npm/node CLI arguments for targeted library names or installation commands that deviate from standard organizational behavior.
Detects Python processes (python.exe, python3.exe, pythonw.exe) performing DNS resolution for Microsoft identity, device login, or Graph API endpoints. This activity is consistent with automated tooling, such as python-requests, performing device-code flow polling or API token authentication within an environment.
Detects the creation of a file on the system that matches a known malicious SHA256 hash.
This rule detects processes attempting to interact with the Docker daemon via its Unix domain socket (/var/run/docker.sock). This is a common technique used by attackers to escape from a container, gain host-level control, or execute arbitrary container administration commands.
This rule detects potentially malicious HTTP requests targeting Alibaba Nacos services. It specifically identifies requests that include 'accesstoken' parameters when accessing sensitive endpoints such as user management, login, or configuration modification paths. This pattern is commonly associated with unauthorized attempts to leverage known Nacos vulnerabilities for credential access or configuration manipulation.
Detects attempts to exploit an unauthenticated Remote Code Execution (RCE) vulnerability in Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing Base64 encoded payloads or direct Python command-line execution patterns, which indicate an attempt to achieve arbitrary code execution.
Detects usage of the Android Debug Bridge (ADB) 'pair' command initiated by processes other than known legitimate Android development tools (e.g., adb.exe, Android Studio). This may indicate an attacker attempting to wirelessly pair a malicious device or gain unauthorized access to an Android device over the network.
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
In DeviceNetworkEvents, we can find both JA4 and JA4S inside AdditionalFields for some TLS connections. This is interesting because we can look at both sides of the same TLS communication. We can compare clients, servers and JA4/JA4S combinations, and look for patterns or connections that behave differently from what we normally see. The following KQL extracts and decodes both fingerprints from the same network event.
This rule identifies the execution or presence of files matching a known list of MD5 hashes associated with malicious activity. By monitoring file metadata, this rule flags instances where specific identified threat files are present on the system.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
Detects attempts to exploit the GitLab commits API via path traversal or direct file path manipulation to access sensitive configuration files or system secrets, such as gitlab-secrets.json, database.yml, or system files like /etc/passwd.
Detects usage of the Android Debug Bridge (ADB) 'pair' command initiated by processes other than known legitimate Android development tools (e.g., adb.exe, Android Studio). This may indicate an attacker attempting to wirelessly pair a malicious device or gain unauthorized access to an Android device over the network.
Detects OtterCookie JavaScript-based RAT/infostealer malware artifacts associated with WaterPlum/Contagious Interview campaign
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
Detects instances where browser extensions interact with specific AI-driven websites (Gemini, Perplexity, Claude) in a manner that bypasses user input or interacts with hidden DOM elements. This pattern is indicative of malicious browser extensions injecting scripts or manipulating content in the background without explicit user authorization, potentially for data exfiltration or automated session interaction.
Detects the installation or update of browser extensions that possess both 'declarativeNetRequest' and 'content_scripts' permissions, while also requesting host permissions for major AI assistant or trusted vendor domains (e.g., google.com, gemini.google.com, copilot.microsoft.com, claude.ai). This specific combination of permissions is characteristic of the BragJack attack chain used to redirect network traffic and hijack AI browser agent sessions.
Detects access, reading, or modification of sensitive credential files (such as KeePass databases, VPN profiles, private SSH keys, and certificates) by a process. This behavior is often associated with pre-encryption staging for data exfiltration during ransomware attacks.
Detects the execution of the s5cmd utility using 'cp' or 'sync' commands directed towards S3 storage paths. This behavior is indicative of unauthorized data exfiltration to attacker-controlled cloud storage, a tactic identified in intrusions associated with the 'Ransom Busters' group.
Page 68 of 347