Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,961
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of a Google Chrome process on a system with a known vulnerability (versions below 143.0.7499.192) in conjunction with browser extension installation or loading activity. This behavior is indicative of the GlicJack exploit (CVE-2026-0628), where a malicious extension attempts to impersonate a trusted AI vendor server to send unauthorized commands to the in-browser AI agent.
Detects the execution of an ONVIF-related tool or process with flags indicating credential retrieval. This is often associated with the reconnaissance or credential access phase targeting IoT devices such as cameras that support the Open Network Video Interface Forum (ONVIF) protocol.
Detects PNG image files containing an 'iTXt' metadata chunk and a specific byte marker (FF 89 AD 4A). This signature is characteristic of LausivLoader, which hides an encrypted payload within the image using steganographic techniques, intended for subsequent extraction via XOR decryption and DEFLATE decompression.
This rule monitors for two distinct stages of potential account recovery abuse. First, it detects the execution of suspected Python scripts on an endpoint that contain command-line arguments related to password recovery or authentication codes. Second, it monitors network proxy/web logs for a high volume of API requests to the 'easy4ipcloud.com' domain associated with password reset or device probe endpoints, which may indicate automated credential stuffing or unauthorized device account recovery attempts.
Detects the execution of the OnvifUser utility with the -u flag, a technique observed in post-exploitation scenarios on Dahua network video recorder (NVR) devices to dump cached credentials.
This rule detects various system events (including process execution and user account creation) that contain the specific string 'p2pwn' in combination with the string 'p2password'. This pattern suggests the activity involves potentially malicious credential testing, hardcoded credential usage, or suspicious account interaction activity.
Detects the presence of PNG image files containing a specific steganographic marker embedded within the iTXt metadata chunk, often used by the LausivLoader malware for C2 communication or payload delivery. The rule looks for the specific marker 0xFF89AD4A or known C2 indicators (yapw.life, stego_zrgaixkku8.png) within PNG files.
Detects the presence of PNG image files containing a specific steganographic marker embedded within the iTXt metadata chunk, often used by the LausivLoader malware for C2 communication or payload delivery. The rule looks for the specific marker 0xFF89AD4A or known C2 indicators (yapw.life, stego_zrgaixkku8.png) within PNG files.
This rule detects the execution of processes where the command line contains suspicious obfuscated substrings. These substrings, which include segments like 'inASISFHfo', 'geASISFHutarvs', 'scASISFHuren', 'fiASISFHu_lsz', 'afASISFHile', or 'ruASISFHunf', are characteristic of command-line obfuscation techniques designed to bypass security monitoring by concealing the true intent of the command.
This rule monitors network HTTP traffic containing specific strings related to gym-membership APIs and client IDs, alongside process or file activity referencing 'getFitnessProfile'. This combination is a behavioral fingerprint associated with a specific Golang-based remote access trojan (RAT) attempting to exfiltrate or interact with fitness profile data.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects individual file access events performed by non-browser python processes. This rule is designed as a proxy to identify automated file collection activities, such as those performed by 'python-httpx', that may be indicative of low-volume data exfiltration when aggregated over time.
Detects evidence of PSNATCH or BASHNATCH tools exfiltrating data to GitHub. The rule identifies suspicious file operations related to an 'SmartUploader' tracking file in standard user directories (AppData, .local/share), monitors for SmartUploader process execution, and flags network connections to api.github.com from processes identified as SmartUploader, bash, or PowerShell.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
This rule identifies Linux devices with kernel versions that are vulnerable to CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. It parses the OSBuild field to extract kernel major, minor, and patch version numbers and compares them against known unpatched releases.
This rule identifies Linux devices with kernel versions that are vulnerable to CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. It parses the OSBuild field to extract kernel major, minor, and patch version numbers and compares them against known unpatched releases.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Page 69 of 347