Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects host-side telemetry indicating Cairn agent worker artifacts, including specific process command line terms, tsec skill files and environment variables, combined with network connections to OpenRouter from the same host.
Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
Detects an AhsayCBS / Tomcat / Java web service process spawning a
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
Detects repeated crashes of GitLab Ruby, Puma, Sidekiq, or bundle processes on Linux within a short time window. The detection looks for crash markers such as segfault, SIGSEGV, SIGABRT, or onigmo in the command line, which typically indicate exploitation attempts against Onigmo regex engine vulnerabilities.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects non-root SSH execution performing remote port forwarding (-R) targeting a Unix socket bind on hosts running the tailscaled daemon, excluding known automation tools.
Detects Tailscale serve commands setting up a TCP forward to a Unix socket (such as tailscaled.sock), correlated with recent file creation, modification, or renaming events involving the socket file by a non-standard process within a 1-hour window.
Detects virtualization management monitor (VMM) processes such as QEMU or Firecracker directly spawning an interactive shell, script interpreter, or network utility as the root user. This behavior is highly anomalous and may indicate a guest-to-host escape leading to remote code execution on the host.
Detects inbound UDP traffic on port 443 (QUIC) targeting known HTTP/3-capable server processes (such as Caddy, Traefik, Cloudflared) followed closely by the termination or crash of that process, which may indicate an exploit attempt or vulnerability leading to denial of service.
Detects web server processes (such as nginx, apache2, httpd, uwsgi, gunicorn, php-fpm) spawning command-line utilities typically used for system and user discovery (such as id, whoami, groups, hostname, uname, netstat, ps, etc.), which often indicates web application exploitation and remote code execution.
Detects potential abuse of WordPress application passwords by correlating an authorization mint request (authorize-application.php) from an administrator's browser with a subsequent REST API page creation request to the same destination server from a different source IP address within a short time window.
Detects a sequence where a FortiSIEM-related process writes or modifies a shell script in a cron or phoenix directory, followed closely within 2 minutes by a child process spawned by cron executing that same written script file.
Detects repeated PHP memory exhaustion (OOM) errors combined with segmentation faults or session warnings within a short timeframe, which may indicate application instability, resource exhaustion attacks, or exploitation attempts.
Detects web servers (httpd, apache2, nginx, php-fpm) or Request Tracker (RT) Perl worker processes spawning suspicious child processes such as shells, downloaders, netcat, or Python interpreters, indicative of post-exploitation or web application compromise.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Page 9 of 347