Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects the execution of 'vsce-sign.exe' with command-line arguments indicating the verification of cached VS Code extensions. This activity is part of the normal VS Code extension installation and update process, where extensions are verified for integrity and authenticity. While this is a legitimate process, monitoring it can be useful for identifying anomalies or potential supply chain compromises if unexpected extensions are being verified or if the verification process itself is being abused.
Detects ctfmon.exe calling NtCreateSymbolicLinkObject or loading cldapi.dll, which indicates the initial stages of the GreenPlasma exploit. This behavior is indicative of process injection or privilege escalation attempts.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Detects suspicious command execution originating from cPanel daemons. This rule identifies instances where cPanel processes (cpsrvd, cpsrvd-ssl, cpaneld, whostmgrd) or their immediate children execute common shell interpreters or specific commands indicative of potential compromise, such as writing to /etc/passwd, modifying authorized_keys, or using base64/perl/python/bash for interactive shells.
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Nginx or Crash Log Deletion
Cortex XDR
Detects command-line activity indicating the deletion of crash core dump files or Nginx logs. This behavior was observed by CL-STA-1132 as a defense evasion technique to cover tracks after exploiting CVE-2026-0300.
This rule detects the execution of the `unshare` utility with parameters to create a new user namespace (`-U` or `--user`). This activity is a known precursor for the Dirty Frag Linux kernel Local Privilege Escalation (LPE) exploit, where an unprivileged user can gain elevated privileges. The rule specifically targets Linux process execution events.
This rule detects the execution of the `unshare` utility with parameters to create a new user namespace (`-U` or `--user`). This activity is a known precursor for the Dirty Frag Linux kernel Local Privilege Escalation (LPE) exploit, where an unprivileged user can gain elevated privileges. The rule specifically targets Linux process execution events.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail). While this is a mitigation step, monitoring for it ensures compliance and tracks remediation efforts.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail). This rule monitors for dynamic unloading of the module using 'rmmod' or persistent configuration changes via 'modprobe.d' to disable the module. While this is a mitigation step, monitoring for it ensures compliance and tracks remediation efforts.
This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.
Detects process executions containing SSH tunneling or port forwarding parameters correlated with outbound network connections to external public IPs. This may indicate protocol tunneling for evasion or data exfiltration.
This rule detects commands executed on Linux systems to mitigate the 'Copy Fail' vulnerability (CVE-2026-31431) related to the 'algif_aead' kernel module. It specifically looks for the dynamic unloading of the module using 'rmmod algif_aead' or the configuration of 'modprobe' to prevent the module from loading by setting 'install algif_aead /bin/false' in a modprobe configuration file.
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
This rule detects the execution of a process on a Linux system where the command line contains a specific URL associated with the 'Copy Fail Exploit Download' (CVE-2026-31431). This indicates an attempt to download or execute a known exploit.
Identifies process execution events or command lines that reference a Control Panel (.cpl) file hosted on a remote UNC path. This isolates the APT28 technique used in CVE-2026-21510 to load remote payloads as CPL objects.
Identifies process execution events or command lines that reference a Control Panel (.cpl) file hosted on a remote UNC path. This isolates the APT28 technique used in CVE-2026-21510 to load remote payloads as CPL objects.
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
This rule detects processes attempting to access web browser credential files (e.g., 'Login Data', 'Web Data') within the AppData directory. This activity is often associated with credential dumping techniques used by adversaries to steal stored browser credentials.
Page 70 of 84