Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
116
41
34
33
20
Contributors
106
38
28
23
20
Categories
165
157
111
46
39
Platforms
229
188
103
9
9
Products / Services
10,660
9,755
6,689
4,418
3,748
295
MITRE Techniques
172
112
60
51
43
CVEs
6
6
3
2
2
IDS Classtypes
4
IDS Protocols
4
This rule detects the Python-based CastleLoader malware establishing persistent WebSocket (wss:// or ws://) command-and-control channels to randomized attacker endpoints. It specifically looks for network connections initiated by python.exe or pythonw.exe to URLs matching a WebSocket pattern, with at least 3 connections within a 5-minute window.
This rule detects lateral movement activity associated with the Impacket toolkit. It monitors for the execution of common Impacket scripts (e.g., psexec.py, smbexec.py, wmiexec.py) or binaries (psexec.exe/PsExec64.exe) spawning from suspicious parent processes or interacting with sensitive Windows shares (ADMIN$, IPC$). Additionally, it flags Python processes performing SMB connections to multiple internal hosts, as well as cmd.exe/powershell.exe instances spawned from services.exe that reference Impacket tool names in their command lines.
Detects the spawning of unexpected child processes such as shell interpreters, download tools, or package managers from vLLM Python serving processes. This activity could indicate a successful exploitation of a vulnerability like CVE-2026-22778, leading to remote code execution through a function pointer overwrite.
This rule detects two stages of a potential exploitation chain targeting vLLM multimodal endpoints. Stage 1 identifies POST requests to vLLM API endpoints that contain 'video_url' in the request context, which could indicate an attempt to exploit CVE-2026-22778. Stage 2 detects post-exploitation activity by looking for unexpected child processes (like shell interpreters or download utilities) spawned from vLLM or Python inference processes, suggesting successful remote code execution.
Detects unexpected child processes (e.g., shell, Python, network utilities) spawned from vLLM or Python worker processes, or suspicious file/network activity related to vLLM/Python processes. This rule aims to identify potential exploitation of CVE-2026-22778, an FFmpeg JPEG2000 heap overflow vulnerability, which could lead to arbitrary code execution within AI/ML environments.
This rule monitors for suspicious child processes spawned by Node.js or npm-related processes (e.g., node, npm, node-gyp). It identifies potentially malicious activity such as shells, Python scripts, or custom scripts executing within the context of 'preinstall', 'postinstall', or 'binding.gyp' phases, which are common vectors for software supply chain compromises via malicious npm packages.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects instances where a Python process is spawned by npm or node and subsequently attempts to access sensitive browser or cloud credential files. This pattern is characteristic of malicious npm packages used for credential theft.
This rule detects processes such as Node.js, npm, or Python accessing sensitive command-line history files including .bash_history, .zsh_history, .fish_history, or ConsoleHost_history.txt. Accessing these files, which often contain credentials or command execution history, is a common indicator of credential harvesting or post-exploitation reconnaissance.
This rule monitors for suspicious activity associated with LegionLoader malware, specifically tracking files and processes interacting with the 'Traiolx Custom Utils' directory. It triggers on the staging of '_socket.pyd', execution of Python interpreters from this directory, and associated C2 communication attempts with the domain 'birdeemusic.com'.
Detects Python scripts or interpreters executing network connections while residing in or interacting with non-standard, potentially suspicious directories or domains. This rule specifically monitors for Python processes (python.exe, pythonw.exe) associated with 'Traiolx Custom Utils', paths within 'AppData\Roaming\python', or network interactions with 'birdeemusic.com' and a specific hardcoded IP address, which are indicative of potential beaconing or command and control activity.
Detects instances where common development runtime processes (e.g., node, python, shells) spawn child processes whose command lines contain references to sensitive credential environment variables such as AWS access keys, GitHub tokens, or SSH authentication sockets. This behavior often indicates that a developer or an automated tool is insecurely passing credentials via command-line arguments to subprocesses.
Detects the execution of AWS CLI commands by common scripting interpreters (Node.js or Python). This behavior is often indicative of automated cloud environment reconnaissance or credential testing using compromised access keys or instances.
Detects Python processes attempting to read sensitive credential files (Login Data, Cookies, logins.json, key4.db) from Chrome, Firefox, and Edge directories. This behavior is indicative of the InvisibleFerret infostealer, which targets browser-stored credentials on compromised developer workstations.
Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.
Detects outbound network connections to known blockchain API endpoints originating from developer scripting runtimes (e.g., node.exe, python.exe). This pattern is consistent with attackers using blockchain transactions as a dead-drop mechanism for retrieving encrypted second-stage payloads, a technique observed in supply chain attacks targeting developers.
Correlates an AI/LLM process executing high-volume network scanning against the internal subnet. This rule detects when processes named 'python.exe' or 'node.exe' initiate a high volume of network connections (more than 20 unique IPs within a minute) to internal IP ranges (10.0.0.0/8 or 192.168.0.0/16).
Detects indicators of active exploitation or malicious activity targeting the Flowise application. The rule triggers on the creation of a 'flowise_marker.txt' file, the spawning of node processes with suspicious command-line flags ('--require', 'node_options') potentially intended to bypass security controls, and the execution of unexpected shell or scripting processes (cmd, bash, python, etc.) by a Flowise process.
Detects execution of MyBB exploitation scripts, specifically targeting the 'mybb_limited_acp_to_admin' PoC, or evidence of a web server process (PHP) spawning suspicious shell or interpreter child processes, suggesting post-exploitation activity on a MyBB platform.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Identifies the Python script explicitly reading developer secrets including AWS credentials, SSH private keys, and Kubernetes configuration files.
Page 7 of 15