Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects repository activity involving the 'FETCH_HEAD' reference, which often indicates automated fetching, local caching, or potential attempts to manipulate or inspect the state of a Git repository during reconnaissance or post-exploitation activities.
Detects an AI coding assistant (e.g., Claude, Copilot, Gemini CLI) attempting to checkout a Git repository and subsequently failing a manual verification check (git rev-parse HEAD) against an expected pinned commit hash. This behavior is indicative of a Plugin4Shell-style supply chain attack attempt, where an adversary tries to inject malicious code into a repository that the AI agent is instructed to use.
Detects successful user authentication events originating from an external source IP address. This rule is intended to identify remote logins that can be correlated with RMM (Remote Monitoring and Management) activity or other remote access patterns.
Detects the use of AI assistant command-line interfaces (such as Claude, GitHub Copilot, or Gemini) to execute git checkout commands with specific commit hashes or references like FETCH_HEAD. This behavior may indicate an attempt to use automated AI tooling to stage or interact with repository code, which could be part of an automated exfiltration or unauthorized code modification attempt.
Detects the execution of a local git force-push operation, which is a technique used by an adversary to overwrite existing repository tags or branches during a software supply chain compromise or repository takeover scenario.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects the execution of Python scripts named 'exploit.py' or 'exp.py', which are common naming conventions associated with proof-of-concept or exploit code.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
This rule detects potential exploitation activities targeting Atlassian Confluence by monitoring for unauthorized access to administrative configuration actions (e.g., setup/setupadministrator.action) and the subsequent addition of accounts to the 'confluence-administrators' group. It correlates process execution, network request patterns, and local user account modifications to identify successful or attempted privilege escalation and configuration manipulation.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
Detects the execution of Python scripts named 'exploit.py' or 'exp.py', which are common naming conventions associated with proof-of-concept or exploit code.
Detects execution of processes masquerading as system threads (e.g., [kcached], [rcu_preempt]) that utilize the command-line flag 'exec -a' and include indicators associated with 'gs-dbus' or specific port configurations (GS_PORT=53). This pattern is often associated with obfuscated command-and-control or malicious persistence mechanisms that attempt to hide within common system process names.
Detects modifications or creations of files within the /var/spool/cron directory specifically involving the postgres user, as well as process execution of the 'crontab' utility by or for the postgres user. This activity may indicate an adversary attempting to establish persistence or execute code with postgres privileges.
Detects anomalous activity originating from or associated with the PostgreSQL service account, including the execution of shells and utilities commonly used for post-exploitation or system enumeration, as well as external network logins. This activity is indicative of credential abuse or container escapes where an adversary attempts to execute commands on the underlying host.
This rule detects the execution of npm or node.js commands involving specific, potentially malicious package names or internal project naming patterns often associated with dependency confusion or supply chain attacks. It monitors npm/node CLI arguments for targeted library names or installation commands that deviate from standard organizational behavior.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.
Detects a Parallels appliance tar archive containing a directory entry name with an embedded double-quote character followed by the --use-compress-program flag, characteristic of the ParaShells (CVE-2026-90894) tar argument-injection payload
Detects a Parallels appliance tar archive containing a directory entry name with an embedded double-quote character followed by the --use-compress-program flag, characteristic of the ParaShells (CVE-2026-90894) tar argument-injection payload
Detects suspicious execution of the 'tar' utility spawned by 'prl_disp_service' (Parallels Desktop service) using potentially malicious command-line arguments. The rule specifically flags the use of '--use-compress-program' or the inclusion of double quotes in the command line, which are often used to achieve arbitrary code execution via shell injection in this context.
Page 85 of 347