Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
95
36
20
19
10
Contributors
35
34
27
18
13
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
58
51
41
23
22
Products / Services
40
30
18
17
13
MITRE Techniques
90
44
34
28
27
CVEs
6
2
2
2
2
IDS Classtypes
14
8
6
3
1
IDS Protocols
20
9
4
1
Detects the use of command-line tools such as rclone, aws CLI, gsutil, and curl to upload files associated with machine learning models (e.g., weights, checkpoints, training datasets) to public cloud storage or AI model hosting platforms. This pattern may indicate the exfiltration of sensitive proprietary AI research or training data.
Detects hosts exhibiting multiple distinct file-manipulation commands (upload, download, stop, delete, append, copy, move) within a single session as identified by the PivotPipe C2 protocol, indicating potential staging, collection, or exfiltration activity.
Detects npm package publication events specifically related to the @dforge-core/dforge-mcp library, including detection of OIDC-based trusted publishing mechanisms to identify potential supply chain compromise or unauthorized releases.
Detects bulk uploads or downloads of AI/ML artifacts, such as model weights, datasets, and configuration files, to suspected personal or external cloud storage providers. This rule is designed to identify potential unauthorized exfiltration of proprietary AI/ML assets.
Detects adversarial attempts to poison Retrieval-Augmented Generation (RAG) knowledge bases. This includes the ingestion of documents containing prompt injection directives (e.g., 'ignore previous instructions'), hidden malicious markup intended to manipulate LLM inference, unauthenticated data ingestion, or abnormal volume spikes from a single source.
Detects unauthorized or potentially malicious file transfer activity within ScreenConnect sessions. The rule flags file transfers occurring on vulnerable versions of ScreenConnect (prior to 26.6.5), transfers that bypass user confirmation prompts, or instances where files are transferred and subsequently executed.
This rule detects PowerShell script execution that interacts with the GitHub API, specifically targeting the upload of files or JSON data to repository endpoints. The logic looks for commands related to file system access, inclusion of 'api.github.com', and references to 'SmartUploader' or 'uploaded_files.json'. It further filters for activity occurring within standard user directories and enforces a check to ensure the GitHub repository name matches the local hostname, which is a common indicator of automated exfiltration scripts.
This rule detects network upload operations (HTTP POST or similar requests ending in '/upload') to a specific external IP address (2.26.126.50). It specifically monitors for processes other than common web browsers, and filters for connections where significant data volume (greater than 10KB) is transferred or the data size is unknown.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects successful POST requests to the WordPress admin-ajax.php endpoint utilizing the 'wwlc_file_upload_handler' action with an empty referrer header. This pattern is characteristic of attackers attempting to upload malicious files via vulnerable WordPress plugins to establish web shell persistence.
Detects successful POST requests to the WordPress admin-ajax.php endpoint utilizing the 'wwlc_file_upload_handler' action with an empty referrer header. This pattern is characteristic of attackers attempting to upload malicious files via vulnerable WordPress plugins to establish web shell persistence.
Detects the publication of a known malicious version (0.2.21) of the '@dforge-core/dforge-mcp' npm package. This activity is attributed to the GHAPPIER/PolinRider supply chain campaign, which leverages hijacked OIDC trusted-publishing pipelines to distribute compromised code.
Detects anomalous activity in GitHub repositories where a code push by an actor is followed by an NPM package publish event from the same actor within a 105-minute window. This behavioral pattern is indicative of a potential compromised maintainer session or malicious code injection into the software supply chain.
This rule detects network upload operations (HTTP POST or similar requests ending in '/upload') to a specific external IP address (2.26.126.50). It specifically monitors for processes other than common web browsers, and filters for connections where significant data volume (greater than 10KB) is transferred or the data size is unknown.
This rule detects network upload operations (HTTP POST or similar requests ending in '/upload') to a specific external IP address (2.26.126.50). It specifically monitors for processes other than common web browsers, and filters for connections where significant data volume (greater than 10KB) is transferred or the data size is unknown.
Detects successful POST requests to the WordPress admin-ajax.php endpoint utilizing the 'wwlc_file_upload_handler' action with an empty referrer header. This pattern is characteristic of attackers attempting to upload malicious files via vulnerable WordPress plugins to establish web shell persistence.
Detects successful POST requests to the WordPress admin-ajax.php endpoint utilizing the 'wwlc_file_upload_handler' action with an empty referrer header. This pattern is characteristic of attackers attempting to upload malicious files via vulnerable WordPress plugins to establish web shell persistence.
Detects successful POST requests to the WordPress admin-ajax.php endpoint utilizing the 'wwlc_file_upload_handler' action with an empty referrer header. This pattern is characteristic of attackers attempting to upload malicious files via vulnerable WordPress plugins to establish web shell persistence.
Detects successful POST requests to the WordPress admin-ajax.php endpoint utilizing the 'wwlc_file_upload_handler' action with an empty referrer header. This pattern is characteristic of attackers attempting to upload malicious files via vulnerable WordPress plugins to establish web shell persistence.
Page 2 of 10