Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,847
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of Git repository operations (clone, fetch, pull, checkout) initiated by AI-assisted coding tools such as Claude Code, GitHub Copilot, or Gemini CLI. The rule specifically excludes interactive operations, identifying automated or scripted usage of these tools to interact with code repositories.
Detects execution and file artifacts associated with the 'fscan' network scanning tool, which is commonly used for internal network discovery and vulnerability scanning. The rule monitors for the presence of the fscan binary or evidence of its output files, specifically 'result.txt', often in combination with scanning parameters like port strings or target service references.
Detects execution and file artifacts associated with the 'fscan' network scanning tool, which is commonly used for internal network discovery and vulnerability scanning. The rule monitors for the presence of the fscan binary or evidence of its output files, specifically 'result.txt', often in combination with scanning parameters like port strings or target service references.
Detects the execution of Python scripts explicitly named 'socks5.py'. This is a common pattern used by adversaries to establish proxying capabilities for command and control or to tunnel traffic through a compromised host.
Detects the creation of files in the /tmp/ directory by common command-line tools (curl, wget, sh, bash), followed shortly by a successful external network connection by the same process from the same device, excluding known benign domains.
Detects reconnaissance commands (e.g., file listing, directory enumeration) executed as child processes of the JFrog Artifactory service. This behavior is often associated with the exploitation of Artifactory plugins or misconfigured endpoints that allow arbitrary code execution, enabling an attacker to perform discovery actions.
Detects anomalous credential retrieval activity occurring within 30 minutes of a GitLab Duo Chat GraphQL subscription request. This pattern is indicative of potential exploitation of CVE-2026-87719, which involves insecure deserialization within the GitLab EE GraphQL subscription serializer to facilitate unauthorized credential access.
Detects anomalous credential retrieval activity occurring within 30 minutes of a GitLab Duo Chat GraphQL subscription request. This pattern is indicative of potential exploitation of CVE-2026-87719, which involves insecure deserialization within the GitLab EE GraphQL subscription serializer to facilitate unauthorized credential access.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
This rule identifies devices within the environment that are susceptible to CVE-2026-81963. It correlates vulnerability data with knowledge base information to flag the software, vendor, version, severity level, and the availability of public exploits for this specific vulnerability.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects the execution of 'bun' during a Node.js package installation process (npm or node). This behavior can be indicative of a supply chain attack where malicious actors attempt to leverage alternative runtimes during the 'preinstall' phase or package installation to execute arbitrary code or bypass security controls typically associated with standard Node.js installations.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
This rule detects suspicious process execution originating from web server applications (e.g., php-fpm, apache2, nginx). It looks for common shell interpreters or command-line utilities (e.g., bash, curl, python) triggered by these web server processes when they contain command execution function strings in their command lines (e.g., system, shell_exec, passthru), which is a common indicator of web shell activity or post-exploitation command execution.
This rule monitors Syslog entries for PostgreSQL 'CREATE_REPLICATION_SLOT' commands to identify potential exploitation attempts associated with CVE-2026-6471. It detects attempts to load logical decoding plugins using suspicious path structures, including path traversal sequences ('../', '..\'), absolute paths, or UNC paths, which are not present in a known-good allowlist of plugins.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.
KQL Query from file: postgresql-server-executes-code-via-malicious-logical-decoding-plugin.kql
Page 90 of 340