Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects a high volume of failed SSH password authentication attempts from a single source IP address against one or more target hosts within a short time window, which is indicative of an SSH brute-force attack.
Detects a successful login attempt by the user account 'p2pwn' targeting port 37777. Port 37777 is commonly associated with DVR/NVR surveillance equipment and is frequently targeted by brute-force attacks and botnets attempting to gain unauthorized access to embedded devices.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects a successful login attempt by the user account 'p2pwn' targeting port 37777. Port 37777 is commonly associated with DVR/NVR surveillance equipment and is frequently targeted by brute-force attacks and botnets attempting to gain unauthorized access to embedded devices.
Detects anomalous activities within CI/CD runner environments, specifically targeting unauthorized processes attempting to access OIDC identity tokens or executing package publication commands (e.g., npm, twine) outside of standard runner execution workflows. This technique is consistent with supply chain compromise efforts to exfiltrate identity tokens and publish malicious artifacts.
Detects anomalous child processes spawned by a Langflow server process that subsequently search for sensitive information, such as cloud credentials or database connection strings, within the command line arguments. This behavioral pattern is indicative of remote code execution exploitation followed by credential harvesting, potentially targeting vulnerabilities like CVE-2026-33017.
Detects Node.js processes, such as npm package postinstall hooks, spawning shell commands used for host enumeration. This includes accessing system environment variables, network configurations, and filesystem metadata, a pattern frequently utilized by malicious packages for initial reconnaissance post-installation.
Detects evidence of persistence mechanisms targeting Docker environments on Linux systems. The rule identifies suspicious modifications using crontab, systemctl (service creation/start), and chattr (to make files immutable), specifically monitoring for artifacts related to '.docker-network-monitor' and 'docker-network-resolver'. It flags systems where multiple such configuration changes occur within a single day.
Detects the execution of the XMRig cryptominer masquerading as the legitimate systemd-logind service. The rule identifies suspicious command-line arguments indicative of mining activity, or instances where systemd-logind is spawned from unauthorized parent processes such as shell interpreters, container engines, or nsenter, which is often characteristic of post-exploitation activity like privileged Docker container escapes.
Detects the CARBONATO botnet using two distinct persistence and evasion techniques: masquerading user-space processes as kernel worker threads by setting command line arguments to '[kworker/u2:0]', or disguising mining binaries as the systemd-logind service. Legitimate kernel threads are spawned by PID 2 and lack an executable path, while the legitimate systemd-logind is expected to be spawned by systemd/init.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.
Detects the use of 'COPY TO PROGRAM' syntax within Cisco Email Security Appliance (ESA) logs. This pattern is indicative of potential command injection or OS command execution attempts often associated with exploitation of database-related functionalities, specifically targeting Cisco ESA management or backend interfaces.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects a suspicious sequence where a Python process is spawned by a 'marimo' notebook process, followed immediately by an outbound SSH connection attempt from the same device. This pattern is indicative of automated or scripted lateral movement where a notebook environment is abused as a jump-point for command execution on remote systems.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects the presence of the malicious 'indexed-btree' npm package, which contains a backdoor that hooks 'BTree.prototype.set' to execute 'sharedLoad.min.js' at runtime. The rule monitors for characteristic file paths, function hooking patterns, and node process spawning behavior designed to evade installation-time static analysis.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
This rule detects suspicious activity related to specific hardcoded indicators 'p2pwn', 'p2password', and references to 'cve-2024-39943'. It scans authentication logs (Identity) and EDR logs (process command lines) for these terms, flagging potential unauthorized access, credential use, or exploitation attempts associated with this specific threat activity.
Detects file creation events involving the 'SmartUploader' configuration file or process execution events referencing the tool, which may indicate unauthorized data collection or staging activity.
Page 7 of 51