Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects file artifacts referencing OtterCandy malware, which combines OtterCookie and RATatouille RAT capabilities, associated with WaterPlum/Contagious Interview campaign
Detects OtterCookie JavaScript-based RAT/infostealer malware artifacts associated with WaterPlum/Contagious Interview campaign
Detects OtterCookie JavaScript-based RAT/infostealer malware artifacts associated with WaterPlum/Contagious Interview campaign
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
Detects instances where a process named 'comet.exe' (or 'comet') accesses sensitive file system locations such as Documents, Desktop, Pictures, or system directories like /etc/ or C:\Windows\. This rule excludes known-legitimate installation and application directories associated with Comet software to reduce noise.
This rule identifies potential SparroWocky malware payload files by detecting a specific custom header (0x11328712 in both little-endian and big-endian format) used for identifying encrypted .dat files that contain embedded RC4 keys.
This rule detects anomalous, high-frequency actions performed by browser extensions that lack concurrent user interaction events (such as keyboard input, clicks, or gestures). It monitors for automated browser API calls or prompts originating from web browsers like Chrome, Edge, and Opera that exhibit potential malicious behavior, such as silent data collection, navigation, or unauthorized scripting.
Detects the execution of a Google Chrome process on a system with a known vulnerability (versions below 143.0.7499.192) in conjunction with browser extension installation or loading activity. This behavior is indicative of the GlicJack exploit (CVE-2026-0628), where a malicious extension attempts to impersonate a trusted AI vendor server to send unauthorized commands to the in-browser AI agent.
Detects embedded CVE-2026-46300 (Fragnesia) Linux privilege escalation exploit code used by KATARU IoT malware, copied unmodified from public PoC
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
This rule detects when common web server service accounts (e.g., www-data, apache) spawn Unix shell processes (sh, bash, dash) to execute system enumeration commands like 'id' or 'whoami'. This activity is often a sign of post-exploitation behavior following successful web application exploitation, where an attacker attempts to determine their context and privileges on the compromised host.
This rule detects when common web server service accounts (e.g., www-data, apache) spawn Unix shell processes (sh, bash, dash) to execute system enumeration commands like 'id' or 'whoami'. This activity is often a sign of post-exploitation behavior following successful web application exploitation, where an attacker attempts to determine their context and privileges on the compromised host.
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects modifications to the /etc/sudoers or /etc/sudoers.d configuration files by non-root users. This activity is often associated with privilege escalation attempts where an adversary attempts to modify sudo policies to grant themselves elevated permissions or bypass password requirements.
This rule identifies Linux devices with kernel versions that are vulnerable to CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. It parses the OSBuild field to extract kernel major, minor, and patch version numbers and compares them against known unpatched releases.
Page 74 of 340