Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
116
41
34
33
20
Contributors
106
38
28
23
20
Categories
165
157
111
46
39
Platforms
229
188
103
9
9
Products / Services
10,660
9,755
6,689
4,418
3,748
295
MITRE Techniques
172
112
60
51
43
CVEs
6
6
3
2
2
IDS Classtypes
4
IDS Protocols
4
Identifies the Python backdoor natively invoking sudo -k -S pwd to silently validate phished credentials against the OS.
This rule detects a scenario where an AI agent (Python or Node.js based) reads a corporate document (PDF, DOCX, TXT, MD) and subsequently spawns a command shell (cmd.exe, powershell.exe, sh, bash) within a 30-second window. This behavior indicates a potential indirect Remote Code Execution (RCE) where a prompt-injected payload from a poisoned document was executed by the AI agent.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects Python executing a web-administration exploit with valid credential input and explicit two-factor bypass logic, matching the AI-assisted semantic trust-flaw exploitation described by GTIG.
Detects Python accessing AWS, Azure, Google Cloud, Kubernetes, Docker, Terraform, or Vault credential stores. This rule specifically looks for Python processes executing commands that contain keywords associated with cloud CLI credential files or configuration paths.
Detects suspicious child processes spawned from AutoGen Studio or mcp.py Python processes, which could indicate a WebSocket command injection vulnerability (AutoJack - CWE-78). The rule looks for common shell or command execution binaries and keywords in the process command line.
Parses outbound network requests from AI applications where sensitive local context (SSH keys, tokens) was successfully extracted and appended to an external URL. Specifically, it looks for network connections initiated by 'python.exe' where the remote URL contains common sensitive parameter names like 'token', 'key', 'data', or 'auth' followed by a string of at least 20 alphanumeric characters, hyphens, or underscores, indicating potential exfiltration of credentials or sensitive data.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
Detects suspicious Python process execution that combines network socket creation with memory manipulation imports (ctypes/mmap) or shellcode-like hex byte strings in the command line. This behavior is indicative of in-memory exploit delivery or staging, often used by adversaries to execute malicious code without writing it to disk. The rule also looks for inline Python execution (-c) with similar indicators.
Detects Python loading a .pyd or .so extension from common user-controlled directories like AppData, Temp, Downloads, or project directories, rather than from a trusted package installation. This behavior is indicative of the InvisibleFerret malware.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the main file executed.
Identifies the Python interpreter executing scripts that import the openai or langchain module combined with OS enumeration modules (os, subprocess) to map environments contextually. This activity could indicate an adversary using AI-related libraries for reconnaissance purposes.
This rule detects the execution of common system discovery commands (such as uname, ifconfig, netstat, ip, and file reading of sensitive paths) by interpreter processes (sshd, bash, sh, python) or vmanage-related processes. This activity is often associated with post-exploitation reconnaissance, where an adversary attempts to map system or network configurations.
Detects a web server or PHP runtime creating or renaming a PHP file inside a REDCap application directory. INFINITERED trojanised legitimate REDCap components and deployed PHP-based persistence. Production REDCap content should normally be changed through controlled deployment or upgrade activity, so unplanned PHP file creation by the serving process requires investigation.
Detects Python deleting runtime scripts, compiled modules, screenshots, and credential archives from temporary or profile paths. This rule specifically looks for file deletion or creation events where the target file matches common Python script/module extensions (.py, .pyc, .pyd, .so) or archive/image extensions (.zip, .7z, .png, .jpg) within temporary or user profile directories, and the process responsible is identified as Python.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Detects the execution of Python or Node.js processes that include command-line arguments indicative of base64 decoding or zlib decompression, often used for deobfuscating and executing malicious payloads in memory.
Detects a reverse shell executed by the Python interpreter during what should be an isolated AI model loading process. This rule specifically looks for common reverse shell patterns (nc -e, bash -i, sh -i, /dev/tcp/) in the command line of processes initiated by 'python.exe'.
Page 9 of 15