Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Identifies devices running PHP versions affected by CVE-2026-109618 or CVE-2026-109619. The detection returns affected hosts, operating system platform, installed PHP version, and associated IPv4 addresses to support vulnerability assessment and remediation.
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Detects Node.js builds, Express, and body-parser libraries vulnerable to CVE-2026-111497 (Node2Shell) via Microsoft Defender vulnerability inventory, process telemetry, and software inventory.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects HTTP requests carrying a Brotli Content-Encoding request body, which serves as the delivery vector for Node2Shell (CVE-2026-111497), an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js and Bun.
Detects post-exploitation activity where a Node.js or Bun runtime process spawns a shell, interpreter, or network download utility, which could indicate exploitation such as CVE-2026-111497 (Node2Shell).
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects execution of a Python proof-of-concept script targeting CVE-2026-111497 that launches node child processes or runs related commands involving Brotli compression files and decompression functions.
Detects network connection and URL events involving IP address 147.135.36.162, identified as a malicious indicator of compromise from the Huntress php2shell advisory.
Detects vulnerable installations of Node.js and Bun based on software inventory data to identify exposure to CVE-2026-111497 (Node2Shell).
Detects repeated execution of the Tailscale VPN client using an authentication key (tskey-auth-) 5 or more times within a 1-hour window on the same device or account, which may indicate mass or rogue node enrollment.
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Detects package manager installations or executions spawned by an AI coding agent (such as claude, codex, or cursor) involving specific indicators like the 'function-color' package or running out of a Downloads working directory.
Detects a Python process spawning a Node.js child process that executes a JavaScript script located within a temporary directory, accompanied by a .json or .br configuration argument, matching known PoC execution patterns (such as CVE-2026-111497).
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects process execution of Node.js or Bun where inline scripts or command-line arguments utilize Brotli decompress functions from the zlib library.
Detects post-exploitation behavior where a Node.js, Node, or Bun runtime spawns a Unix shell process (such as sh, bash, or dash) with command line arguments indicative of code execution, reverse shells, or download tools (e.g., -c, /dev/tcp, mkfifo, curl, wget, nc, base64).
Detects potential manipulation of Anthropic Claude configurations via command-line setting of ANTHROPIC_BASE_URL to non-standard endpoints, or the creation/modification of Claude configuration files (CLAUDE.md, AGENTS.md, or settings.json) within user Downloads directories.
Detects the execution of the php-up-2026 framework symbol extraction script (php_up_framework.py) using specific command line flags including --syms and --binary targeting the lsphp binary via python interpreters.
Page 1 of 174