Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects Microsoft Edge (msedge.exe) spawned by command shells or script hosts with hidden or headless window parameters, or communicating with webhook.site, which is commonly indicative of malicious browser automation or exfiltration.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Detects suspicious Ghostscript execution patterns where Python spawns Ghostscript with dangerous I/O pipe arguments or disabled SAFER mode, or where Ghostscript spawns shell interpreters.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Detects command execution patterns on NetScaler appliances involving the extraction of system details (id, uname, hostname, nsrelease) and writing or echoing them into HTML files within NetScaler web directories, indicative of web shell installation or staging.
Detects GitLab backend processes (such as puma, sidekiq, rails, ruby, bundle) spawning shells, scripting interpreters, or network tools with suspicious command-line parameters, potentially indicating post-exploitation activity or vulnerability exploitation.
Detects the creation of AI coding assistant configuration files (such as .cursorrules, CLAUDE.md) in user directories (Downloads, Desktop, Temp) by non-git processes, followed within a short time window by execution of interpreters or tools (like node, npm, powershell, cmd, curl) with suspicious command line parameters indicating possible download or script execution.
Detects when AI coding agent processes (such as Claude, Cursor, Copilot, Windsurf, Codeium, or Aider) spawn command shells or download utilities with command lines indicative of downloading and executing external payloads.
Detects a burst of newly created Python or Shell scripts on a host running the Zammad ticketing system, which can indicate post-exploitation activity or automated staging.
Detects an Xoscar or Xinference Python actor pool process spawning a Unix shell child process with suspicious command-line flags (such as reverse shell indicators, downloads, or base64 decoding), potentially indicative of cloudpickle deserialization remote code execution (CVE-2026-49950).
Detects when a shell process (such as sh, bash, dash, cmd.exe, or powershell.exe) is spawned by a metrics, logging, or authentication management service shortly after the service accepts an inbound network connection, potentially approximating exploitation of an internal management service.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Detects web server processes (such as apache2, nginx, httpd, php-fpm, or w3wp.exe) spawning shell interpreters (such as bash, sh, cmd.exe, or powershell.exe), which is a common indicator of web shell activity or application exploitation.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects suspicious process execution where a shell or scripting tool is spawned by the nsppe process or running under the nobody account, followed closely by file creation or modification activity in persistence locations or NetScaler GUI web directories.
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Page 2 of 154