Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects various techniques used to escape from Linux container isolation, including accessing container daemon control sockets (Docker/containerd), abusing namespace operations (nsenter/setns), mounting sensitive host filesystem paths (e.g., /proc/1/root), performing chroot escapes, and abusing privileged capabilities or socket-based execution.
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects instances where a file is downloaded or exfiltrated, followed by the deletion or alteration of its version history within a 7-day window. This behavior is consistent with post-theft activities aimed at obfuscating access logs or sanitizing stolen data by removing original versioning markers, often observed in insider threat or compromised account scenarios.
Detects unauthorized modifications to the .ssh/authorized_keys file. Such changes are often performed by adversaries to establish persistence by ensuring their own public keys allow them remote access to the host. The rule filters out known configuration management and system tools to reduce noise.
Detects the deployment of the Hermes Agent AI framework by the Carbonato botnet. The rule identifies the creation or modification of a 'SOUL.md' persona file within specific directories (/root/.hermes/ or /opt/netd/) followed by an outbound network connection to a known LLM gateway IP or the Telegram API. This pattern is indicative of a post-exploitation AI agent being installed for command and control or task execution.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects potential persistence mechanisms on Windows systems by monitoring for the creation or modification of Registry 'Run' or 'RunOnce' keys, as well as the creation of files within the Windows Startup folder. These actions are commonly used by adversaries to ensure malicious code executes automatically upon user login or system startup.
Detects the creation, modification, or renaming of common JSP web shell filenames (x.jsp, u.jsp, u2.jsp) within known web application directories (e.g., webapps, Peoplesoft, WebLogic). This pattern is indicative of an adversary attempting to establish a web shell for persistent access or command execution on a vulnerable web server.
Detects Gamaredon (Armageddon) group activity characterized by Microsoft Office applications (winword.exe or excel.exe) writing to global template files (Normal.dotm or Personal.xlsb) to implant malicious macros, or dropping .vbs or .lnk files into startup or template directories to achieve persistence and facilitate further propagation.
Detects lateral movement via PsExec (PSEXESVC) followed by mass file encryption/rename activities and the creation of ransom note files, characteristic of Wizard Spider's deployment of Conti ransomware.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a burst of file delete or overwrite operations initiated by a configured AI agent service identity. This behavior, if deviating from established baselines, may indicate a compromised agent performing malicious destructive activities such as mass data deletion or ransomware-style file destruction.
Detects anomalous, high-volume file deletion, modification, or resource deletion operations performed by an identified AI agent service account within a short timeframe. This behavior is indicative of a compromised AI agent being leveraged for mass data destruction, ransomware activity, or disruptive configuration changes.
Detects non-browser processes (e.g., non-chrome.exe/msedge.exe) modifying critical browser configuration files such as 'Secure Preferences' followed by near-simultaneous writes to extension-related directories like 'Extension State' or 'Extensions'. This pattern is indicative of a malicious attempt to bypass browser security integrity checks to silently install or load unauthorized extensions.
Detects the creation or writing of executable binary files (e.g., .exe, .dll, .bat, .ps1, .vbs, .scr) to sensitive Windows administrative shares (ADMIN$, C$, IPC$) via SMB. This behavior is indicative of lateral movement where an attacker attempts to stage tools or scripts on a remote system for subsequent execution.
Detects creation or modification of files under /etc/sudoers or /etc/sudoers.d/ by a
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects unauthorized or anomalous modifications to machine learning model checkpoints. The rule triggers on significant deviations in weight delta percentages outside of scheduled fine-tuning windows, or when a model checkpoint hash is altered by users or service accounts without corresponding CI/CD pipeline approval or documented code review.
This rule detects potential ransomware activity by correlating a rapid burst of file creation, modification, or renaming events across multiple directories with prior execution of defense evasion commands, such as deleting volume shadow copies or terminating security-related processes. This sequence is characteristic of ransomware operators attempting to disable recovery options and security protections before commencing mass file encryption.
This rule performs a retrospective search across device file and network events for indicators of compromise associated with the UNC6240/ShinyHunters actor's activity against PeopleSoft, specifically linked to CVE-2026-35273. It monitors for known malicious file hashes (JSP webshells and executables), connections to known C2 infrastructure, and DNS lookups for specific malicious domains.
Page 7 of 110