Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects command output staged in a temporary file (/tmp/nx_cmd.txt) by a Unix shell spawned from ExifTool or Perl, typically resulting from Gotenberg CVE-2026-42589 exploitation, or detects the specific staging filename behavior independently.
Correlates an IDE or extension host process querying api.ipify.org with a subsequent git command configuring the global user email on the same device within a 5-minute window. This behavior can be indicative of malicious setup or automated post-compromise activity.
Detects behavioral indicators of an SSH or autossh reverse tunnel (-R) executed with no remote command (-N) and host-key checking disabled, combined with network connections to a known command and control IP address.
Detects a sequence where an UpdraftCentral management request is made to a WordPress site followed by plugin installation or user creation requests from the same source within a 30-minute window, potentially indicating unauthorized plugin installation or webshell deployment via compromised management endpoints.
Detects a sequence of events on a Linux device where a sudo command execution is followed within 15 minutes by a Perl process executing base64 decoding commands within the same SSH session.
Identifies devices running Request Tracker (RT) applications, processes, files, or network services, and flags instances with vulnerable versions or specific CVEs (CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44229, CVE-2026-44230, CVE-2026-44231) below version 5.0.10.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects potential SQL injection (SQLi) attempts targeting web applications by identifying multiple requests matching specific SQLi regex patterns combined with encoding or internal reference markers within web access logs.
Detects the SITE CPFR and SITE CPTO command sequence in ProFTPD logs, which is characteristic of exploiting the mod_copy vulnerability (CVE-2015-3306) to copy files without authentication.
Detects ProFTPD FTP server commands where an adversary uses SITE CPFR (Copy From) to reference a sensitive file path (such as /etc/passwd or SSH keys) followed by SITE CPTO (Copy To) on the same host within a 10-minute window, which indicates potential staging or unauthorized copying of sensitive system files via FTP.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects Tailscale (tailscaled) reaching out to cloud instance metadata endpoints or Kubernetes internal service APIs, which may indicate unauthorized access or abuse of app connectors.
Detects a web server process (apache2, httpd, php-fpm) spawning a Unix shell (dash/sh) that executes discovery commands such as id, whoami, hostname, or find. This is the durable post-exploitation signature of the wp2shell WordPress pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137), where a malicious plugin or webshell executes commands through the web stack.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios
Detects endpoint network connections made to known staging IP addresses often associated with data exfiltration or staging activities.
Page 8 of 347