Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.
Detects suspicious process execution chains involving 'regsvr32.exe' followed by 'mshta.exe', 'powershell.exe', or 'rundll32.exe', especially when 'regsvr32.exe' is launched from common user download or application data directories. This pattern is often indicative of malware execution or living-off-the-land techniques.
Detects TCP connections to ports commonly associated with reverse shells,
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
Detects attempts to access or exfiltrate the default Kubernetes service account token file using web utilities like curl or wget. This activity is commonly observed in attacks by threat actors such as Slow Pisces to escalate privileges or move laterally from a compromised pod into backend cloud infrastructure.
This rule detects the execution of package managers by common parent processes when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.
This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.
This rule detects suspicious activity involving multiple POST requests to Livewire update endpoints on web servers, followed by the spawning of unusual processes from web server parent processes (php, apache, httpd, nginx, php-fpm). The spawned processes of interest include various shells (sh, bash), command-line tools (curl, wget, python, perl, nc), or commands containing base64 encoding, chmod +x, or /tmp/ paths. This behavior could indicate a web shell compromise or successful exploitation leading to command execution.
Detects FoxitPDFReader.exe spawning suspicious child processes which may indicate DLL sideloading exploitation used by Qilin ransomware
This rule detects suspicious process command-line activity on devices identified as ATMs. It looks for known malware-related executables (CSCSERVICE.EXE) and common ATM software components (DISPENSR, XFS, MSXFS, AGILIS, APTRA, PROCASH, *.xfs) being executed or initiated by unusual processes like svchost.exe, rundll32.exe, or regsvr32.exe. This activity could indicate an attempt at ATM jackpotting or other unauthorized access.
This rule detects the execution of hidden shell scripts within the `/tmp/` directory on Linux systems, specifically looking for `nohup` commands that launch a shell (`sh` or `bash`) to execute a hidden `.sh` file (e.g., `.eba9ee1e4.sh`). This behavior is indicative of the UAT-10608 / React2Shell threat, often associated with credential harvesting operations.
Detects network connections to malicious domains, associated IPs, execution of related malicious file hashes, registry persistence, and postinstall script executions related to UNC1069 NPM/Axios supply chain attacks deploying SILKBELL and WAVESHAPER.V2. Categorized into risk-scored scenarios.
Detects network connections to a suspicious Vercel application URL ('vscode-ext-git.vercel.app') combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential ingress tool transfer or data exfiltration attempts.
Detects node.exe spawning potentially malicious child processes such as curl, cscript, wscript, powershell, or cmd where the command line does not reference the legitimate npm registry. During normal npm operations, node should resolve packages and write to node_modules, not shell out to system utilities for downloading or executing scripts. This behavior was observed in the axios npm supply chain compromise (March 2026), where a trojanized postinstall hook in plain-crypto-js caused node to spawn curl and cscript to fetch and execute stage-2 RAT payloads from an external C2 server. This detection excludes legitimate npm registry traffic to reduce false positives from normal package installation activity.
Detects CrystalX-style browser clipper behavior when specific command-line patterns (CDP or clipper commands) appear in conjunction with a CrystalX temporary payload lineage. The temporary payload is identified by an executable named 'svc' followed by 3 to 6 digits, located in the user's AppData\Local\Temp directory.
Detects network connections to a suspicious Vercel application URL combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential data exfiltration attempts as noted in the linked blog post.
Detects the execution of high-risk SAP ABAP programs identified in a sensitive program list. These programs, often used for administrative or internal testing purposes, can bypass standard SAP transaction-level authorization checks, making them attractive targets for privilege escalation or unauthorized data access.
Detects network activity consistent with a user attempting to download or install OpenClaw or a known variant — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for access to OpenClaw distribution URLs including GitHub releases, the install script endpoint, raw GitHub content, and npm registry paths for known variants. Also detects variant names appearing in process command lines at the time of a network connection, covering alternative package managers and runtimes such as Bun, pnpm, Yarn, and Deno in addition to traditional browsers and shell tools. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Detects PowerShell execution with suspicious Base64 decoding, commonly linked to malware installation
Detects suspicious command-line arguments used with Windows utilities (LOLBAS)
Detects the execution of scriptlet files or the use of scrobj.dll (squiblydoo)via command line, particularly when initiated by common scripting or command interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe.
Detects installation and post-installation activity associated with OpenClaw and its known variants — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for npm global install commands, execution of shell installer scripts, OpenClaw-related binary or package files written to disk, and outbound network activity originating from known OpenClaw agent processes. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Page 116 of 154