Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
Detects coordinated behavioral signals associated with the CVE-2025-25249 campaign, which deploys the PivotC2 Node.js RAT on FortiGate devices. The rule correlates anomalous inbound CAPWAP (UDP/5246) traffic, Node.js process execution, suspicious JavaScript file writes, and unauthorized access to Fortinet configuration files, followed by long-lived outbound TLS beacons to non-standard ports.
This rule monitors network connections, file events, and process execution command lines for references to a list of known malicious URLs, including indicators associated with ClearFake, IClickFix, AMOS, Remus, and Mozi botnet payloads.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects execution of the 'socat' utility with command-line arguments indicating the establishment of a network listener. Socat is a multipurpose relay tool that can be abused by adversaries for pivoting, proxying traffic, or creating reverse shells by establishing listener ports.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
Detects repository activity involving the 'FETCH_HEAD' reference, which often indicates automated fetching, local caching, or potential attempts to manipulate or inspect the state of a Git repository during reconnaissance or post-exploitation activities.
Detects an AI coding assistant (e.g., Claude, Copilot, Gemini CLI) attempting to checkout a Git repository and subsequently failing a manual verification check (git rev-parse HEAD) against an expected pinned commit hash. This behavior is indicative of a Plugin4Shell-style supply chain attack attempt, where an adversary tries to inject malicious code into a repository that the AI agent is instructed to use.
Detects successful user authentication events originating from an external source IP address. This rule is intended to identify remote logins that can be correlated with RMM (Remote Monitoring and Management) activity or other remote access patterns.
Detects the use of AI assistant command-line interfaces (such as Claude, GitHub Copilot, or Gemini) to execute git checkout commands with specific commit hashes or references like FETCH_HEAD. This behavior may indicate an attempt to use automated AI tooling to stage or interact with repository code, which could be part of an automated exfiltration or unauthorized code modification attempt.
Detects the execution of a local git force-push operation, which is a technique used by an adversary to overwrite existing repository tags or branches during a software supply chain compromise or repository takeover scenario.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects the execution of Python scripts named 'exploit.py' or 'exp.py', which are common naming conventions associated with proof-of-concept or exploit code.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
This rule detects potential exploitation activities targeting Atlassian Confluence by monitoring for unauthorized access to administrative configuration actions (e.g., setup/setupadministrator.action) and the subsequent addition of accounts to the 'confluence-administrators' group. It correlates process execution, network request patterns, and local user account modifications to identify successful or attempted privilege escalation and configuration manipulation.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
Page 76 of 340