Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,829 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
9,730
2,538
1,168
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,773
3,899
2,668
2,013
1,825
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects the launch of bad-bpf style eBPF rootkit loaders (pidhide with --pid-to-hide, sudoadd with --username) executed via sudo or from an interactive shell parent, representing the userspace step that issues bpf(BPF_PROG_LOAD) before tracepoint hooks go live.
Detects an npm or pip package installation process spawning a script
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
Detects execution of the XMRig Monero cryptominer or a miner
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects potential defense evasion activity where Windows Defender configurations are modified or disabled, followed closely within 20 minutes by a silent, quiet, or unattended software uninstallation initiated by a script interpreter or command processor on the same device.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects the AnyDesk Linux service running as root spawning a shell process (sh, bash, dash, zsh) or executing a command associated with the AnyPwn (CVE-2025-27918) post-exploitation behavior.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects SSH clients launched with reverse (-R) or dynamic (-D) port
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects the usage of command-line flags in AI coding assistant CLIs (such as Claude Code, Amazon Q CLI, and others) that intentionally skip security permissions, bypass approvals, or disable sandbox protections. The rule identifies potential developer activity that may inadvertently reduce the security posture of the development environment.
Detects instances where package managers (pacman, makepkg, yay, paru) or their children spawn a root shell that downloads and executes external scripts via curl or wget.
Detects the sequential relationship of data staging using tools like WinRAR and subsequent exfiltration using tools like Rclone, WinSCP, or FileZilla on a single host within a 24-hour window.
Detects PowerShell processes spawned by common managed file transfer (MFT) or web service processes (such as Serv-U, GoAnywhere, MOVEit, Cleo, Tomcat, etc.) performing remote system discovery or ingress tool transfer activities.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects the execution of archiving utilities (7z, rar, tar, or Compress-Archive) targeting configuration directories of AI coding assistants such as Claude, Codex, Cursor, and Gemini.
Detects a sequence of events indicative of Bring Your Own Vulnerable Driver (BYOVD) attacks or security control impairment. It monitors for the loading of a rare driver (seen on 3 or fewer hosts), accompanied by either the creation of a kernel service or defense tampering activities such as disabling security monitoring or stopping security-related services.
Page 11 of 564