Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Detects unexpected shell or command interpreter processes spawned as children of the vLLM or Python worker processes. This behavior strongly indicates a successful Remote Code Execution (RCE) payload, such as a system() call, resulting from the CVE-2026-22778 JPEG2000 heap overflow exploit.
This rule detects potentially unauthorized or suspicious command execution originating from AI development assistant processes such as Claude, Cursor, Amazon Q, or Node-based environments. It specifically monitors for the invocation of shell commands (e.g., bash, sh -c) or package managers (npx) that interact with sensitive AI assistant configuration files (e.g., .amazonq, mcp.json), which could indicate an adversary attempting to leverage AI integration paths for unauthorized command execution or persistent configuration manipulation.
Detects when development tools such as VS Code, VS Code OSS, or Node.js spawn a shell (bash/sh) to execute network-related commands (aws, curl, wget, npx). This behavior is characteristic of an adversary leveraging a developer's environment to download payloads, interact with cloud resources, or perform reconnaissance.
Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.
Detects macOS Terminal (bash/zsh) retrieving 'loader.sh' or 'payload.applescript' directly from the ClickFix attacker infrastructure, indicating potential compromise related to the ClickFix campaign.
Detects a reverse shell executed by the Python interpreter during what should be an isolated AI model loading process. This rule specifically looks for common reverse shell patterns (nc -e, bash -i, sh -i, /dev/tcp/) in the command line of processes initiated by 'python.exe'.
Detects vLLM processes spawning interactive Unix shells, a strong indicator of remote code execution, potentially exploiting CVE-2026-22778.
Detects attempts to inject shell metacharacters or command substitution into VNC-related operations, specifically targeting the 'start vnc' command within network connection URLs or process command lines. This rule aims to identify potential command injection vulnerabilities being exploited.
This rule detects potential supply chain attacks where a Node.js process (npm, npx, node) triggers an unauthorized shell, scripting interpreter, or network utility (such as curl, wget, powershell, or bash) to execute commands. This behavior, when followed by file creation in temporary directories (e.g., /tmp, AppData\Local\Temp) within a 5-minute window, is indicative of malicious npm postinstall hooks, commonly seen in supply chain compromise campaigns.
Identifies execution of the Linux/macOS bash cradle used by GLASSWORM's WASM loader. It looks for curl fetching the specific OS path structure ('/linux/i/_' or '/darwin/i/_') and piping to bash.
Detects the Linux ZiChatBot component executing from the obsHub temporary directory with the obs-check-update name after being made executable.
Detects the Bomgar process piping the output of a command shell directly into a network socket, establishing an interactive reverse shell. This often indicates exploitation of a Bomgar vulnerability.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
This rule detects suspicious script execution on macOS devices that targets known cryptocurrency wallet applications or data files. It looks for command-line executions involving common shell interpreters (sh, bash, zsh, osascript) that contain strings associated with Ledger Live, Trezor Suite, Exodus, Electrum, or generic 'wallet.dat' files. This activity could indicate an attempt to steal cryptocurrency wallet information or funds.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects the use of the 'watch' command in conjunction with 'cat' to continuously poll the GitHub CLI config file (.config/gh/hosts.yml). This activity could indicate an attacker attempting to capture new GitHub tokens as soon as a developer logs in.
Detects suspicious execution of 'osascript' by processes that are not typically user-interactive, often indicative of C2 command dispatch or malicious AppleScript execution. The rule specifically looks for 'osascript' being spawned by processes other than common user applications (Finder, Terminal, iTerm2, etc.) or Apple-related processes, and checks for command-line arguments associated with executing shell commands via AppleScript or direct shell command execution patterns.
Detects instances where 'osascript' is used to execute commands that include suspicious keywords often associated with obfuscated or malicious scripts. This can indicate an attempt to run arbitrary code, potentially for initial access, execution, or persistence on macOS systems.
Detects the execution of curl commands that involve base64 decoding, often used by adversaries to download and execute obfuscated scripts or payloads. The rule specifically looks for common shell utilities (curl, zsh, bash, sh) executing commands containing 'base64 --decode' and 'curl', along with specific suspicious domains or a generic base64 encoded string pattern.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
Distinct scripts can not look dangerous based on their extension, but they are still executable files. In environments with macOS, Linux, WSL, Git Bash or Python Launcher, this can help to identify scripts renamed to hide their real purpose.
Distinct scripts can not look dangerous based on their extension, but they are still executable files. In environments with macOS, Linux, WSL, Git Bash or Python Launcher, this can help to identify scripts renamed to hide their real purpose.
Detects the Linux ZiChatBot component executing from the obsHub temporary directory with the obs-check-update name after being made executable. This rule specifically looks for process creation events where the executable name is 'obs-check-update' and the file path is within '/tmp/obsHub/' or '/var/tmp/obsHub/'.
Page 33 of 45