Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects process execution or file creation/modification events associated with the PACKET_EDIT_MEME (pedit_cow_demo) exploit, which targets Linux kernel vulnerabilities (CVE-2026-46331) for local privilege escalation.
Detects modification of /etc/ld.so.preload to register the MYRA RAT rootkit shared library (.libcache.so) for system-wide LD_PRELOAD injection. The MYRA npm package (apintergrationpost) copies libcache.so to /usr/local/lib/.libcache.so and appends its path to /etc/ld.so.preload, causing the rootkit to load into every new process on the system.
Detects malicious npm package behavior where a package uses 'npm pack' and associated script files (e.g., sync-peer.cjs) to download and overwrite its own installed files. This technique is often used in software supply chain attacks to bypass static analysis of the original package tarball by fetching a second, malicious version at runtime.
Detects the execution of 'unshare' by an unprivileged user to create a new user namespace, followed by a write operation to '/proc/self/uid_map', '/proc/self/gid_map', or '/proc/self/setgroups'. This sequence is a known technique for local privilege escalation (LPE) vulnerabilities, such as those related to unprivileged user namespaces.
Detects node.exe or node process accessing sensitive SSH private key files or configuration files. This behavior is indicative of unauthorized credential harvesting by malicious npm packages or infostealer malware like Miasma/MYRA attempting to exfiltrate developer secrets.
Detects Node.js processes (node, npm, npx) accessing or modifying '.npmrc.bak' or '.npmrc' files located within 'node_modules' directories. This activity is indicative of credential theft, specifically targeting potentially active npm authentication tokens that might have been inadvertently backed up or exposed within project directories.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
This rule detects suspicious activity related to Node.js applications that may indicate malicious manipulation of the environment or persistence mechanisms. It monitors for the loading of a specific hidden library (.libcache.so), usage of the LD_PRELOAD environment variable by node/npm processes, modifications to profile scripts, and irregular crontab entries associated with node execution. This behavior is indicative of dynamic linker hijacking or unauthorized task scheduling for persistence.
Detects persistence mechanisms used by the MYRA Linux RAT, specifically targeting the modification of /etc/ld.so.preload, the deployment of a malicious library (.libcache.so) to /usr/local/lib/, and suspicious shared object file creation in temporary directories (/tmp or /dev/shm) initiated by Node.js or npm processes. This behavior was observed in the Polymarket Trap npm supply chain campaign.
Detects a malicious post-install technique where an npm package utilizes node.exe to perform an 'npm pack' and overwrite critical files within the node_modules directory. This behavior, observed in the Miasma/Polymarket Trap, is designed to bypass static analysis performed during initial installation by swapping legitimate files with malicious variants after the fact.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects unauthorized or anomalous modifications to local vector database files (e.g., ChromaDB, FAISS SQLite) by non-standard processes, indicating an attacker attempting to poison the AI's retrieval context directly. The rule specifically looks for file modifications or renames of common vector database files (chroma.sqlite3, faiss_index.index, index.faiss) where the initiating process is not a standard AI/ML runtime (python.exe, node.exe, docker.exe) and there is an outbound network connection from that process to a non-localhost IP.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
Detects anomalous activity originating from Oracle database processes, including the spawning of shell commands via DBMS_SCHEDULER, execution of known attacker staging scripts, and the creation of sensitive output files in temporary directories, which are characteristic of database-level remote code execution or exfiltration attempts.
Detects indicators of abuse involving remote monitoring and management (RMM) tools like AnyDesk and N-able. The rule identifies suspicious LNK files masquerading as software configuration, configuration files placed in non-standard locations, the addition of RMM components to Windows Registry run keys, and the execution of RMM agents with silent flags, all of which are common tactics for establishing persistence and unauthorized remote access.
This rule detects activities related to Operation Escaneo, specifically focusing on the creation, modification, or access to cleartext credential harvesting files (e.g., vpn-passwords.txt) and the execution of associated Python scripts (forti_login2.py, forti_login3.py) used for credential staging and extraction on FortiGate systems.
Detects the creation or modification of a file named 'System.dll' within a subdirectory of the 'C:\Windows\Temp' directory where the writing process is not signed by Microsoft. This behavior is indicative of potential DLL sideloading or masquerading attempts, where an attacker drops a malicious DLL in a writable directory to be loaded by a legitimate process.
Detects the staging and potential execution of Java deserialization payloads associated with the ysoserial CommonCollections5 (CC5) exploit, which leverages the BadAttributeValueExpException gadget chain.
Page 80 of 110