Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
This rule detects the use of the VS Code command line interface to install extensions, specifically by monitoring for the 'workbench.extensions.installExtension' command. This activity can be indicative of automated installation of extensions, which could be used for malicious purposes or persistence if an attacker installs a malicious extension.
Detects modifications or creation of the VS Code 'settings.json' file within a '.vscode' folder where the configuration includes 'workbench.startupEditor' and 'readme'. This pattern is frequently used in malicious extensions or malicious repository configurations to trick users into opening a malicious README file upon starting the editor, potentially leading to further compromise.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects SSH persistence planted during the Red Heron campaign: authorized_keys file writes under a .ssh folder, correlated with process command lines referencing authorized_keys and the operator's observed key comment naming pattern (backdoor / root-shell).
Detects the execution of s5cmd.exe with command line arguments indicative of data transfer operations (sync, cp, mv, run) to or from an 's3://' URI. s5cmd is a high-performance command-line tool frequently used for parallel S3 operations, which may be leveraged by adversaries for rapid data exfiltration or staging.
Detects the indexed-btree npm malware loader embedded in BTree.prototype.set that spawns a detached hidden Node.js child process and references sharedLoad.min.js
Detects usage of the 'gem' command (install, build, push, publish) that includes naming patterns or specific command strings associated with the GemStuffer supply chain compromise campaign. This targets attempts to introduce malicious dependencies into the environment using RubyGems.
Detects the execution of Ruby or Yard processes where specific command-line arguments (e.g., --load) are used to invoke potentially malicious Ruby script files like evil.rb, loader.rb, or script.rb. This pattern is indicative of an adversary leveraging existing legitimate tools to execute arbitrary script code.
Detects the forged Next.js Server Action invocation used to deliver the
RCE payload after the encryption key has been disclosed. The request is
a multipart/form-data POST containing a "$ACTION_REF_*" field together
with the numbered "$ACTION_<ref>:0/1/2" descriptor fields (action id,
argument list, base64-encoded AES-GCM ciphertext for the closure-bound
args) plus one additional attacker-controlled form field carrying the
payload. Legitimate Server Action calls originate only from the app's
own client bundle and do not normally arrive as raw multipart posts
crafted with a generic HTTP client / no browser fingerprint, especially
shortly after a manifest-disclosure request from the same source (see
companion rule "Next.js Server-Reference-Manifest Disclosure via
Backslash Path Traversal").
RCE payload after the encryption key has been disclosed. The request is
a multipart/form-data POST containing a "$ACTION_REF_*" field together
with the numbered "$ACTION_<ref>:0/1/2" descriptor fields (action id,
argument list, base64-encoded AES-GCM ciphertext for the closure-bound
args) plus one additional attacker-controlled form field carrying the
payload. Legitimate Server Action calls originate only from the app's
own client bundle and do not normally arrive as raw multipart posts
crafted with a generic HTTP client / no browser fingerprint, especially
shortly after a manifest-disclosure request from the same source (see
companion rule "Next.js Server-Reference-Manifest Disclosure via
Backslash Path Traversal").
This rule detects potential web shell activity within the 'Admin Menu Editor Pro' WordPress plugin. It searches for PHP files containing a combination of sensitive execution functions (e.g., eval, base64_decode, system) which are characteristic of the malicious code injected into versions 2.35/2.36 of the plugin during its supply chain compromise.
Detects compromised versions (2.35 and 2.36) of the 'Admin Menu Editor Pro' WordPress plugin that were distributed via the official update infrastructure. These versions include embedded web shell code, as indicated by the presence of both plugin identification strings and common PHP execution or command-line utility functions used in backdoors.
This rule detects potential privilege escalation to root originating from Acronis backup plugin processes on hosting platforms like cPanel, WHM, and Plesk. It flags cases where a non-root Acronis process spawns a child process with root effective UID or when the process UID itself changes to zero, potentially exploiting vulnerabilities such as CVE-2026-87886. The rule also correlates this behavior with suspicious file permission changes (chmod/chown) on Acronis plugin directories.
This rule identifies servers running an outdated and vulnerable version (1.9.3 HF3) of the Acronis Backup plugin within cPanel, WHM, or Plesk environments. This specific version is known to be vulnerable to CVE-2026-87886.
Detects obfuscated PHP code within the Admin Menu Editor Pro plugin, specifically targeting indicators associated with the supply chain compromise of versions 2.35 and 2.36. The rule searches for common PHP execution functions used in web shells within the context of the vulnerable plugin directory.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Page 78 of 340