Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
This rule detects the spawning of a root shell from specific SUID binaries (su, sudo, doas, passwd, chsh) when the initiating process was run by an unprivileged user. This behavior is indicative of a privilege escalation exploit, potentially related to CVE-2026-45257 (BUMSRAKETE).
This rule detects scripts abusing the tenant list upload feature on Cisco SD-WAN managers. Such misuse can expose customer networks or implant changes at scale. It is crucial to review who ran the script and what file was uploaded. If this alert fires, investigate the user's recent activities, specifically if they installed new software or clicked any suspicious links. Involve your security team if the situation remains unclear.
Detects the initial execution phase of the Phantom Gyp technique where a node-gyp rebuild command is abused to execute a silent payload and return a fake C stub file. This behavior is associated with the Miasma npm supply chain attack.
Detects Unix shell commands executed via web application context
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
This rule detects the creation, modification, or renaming of files associated with PCPJack/TeamPCP malware on Linux systems. It specifically looks for these activities in common temporary directories (`/tmp/`, `/dev/shm/`, `/var/tmp/`) and for files with names matching known PCPJack/TeamPCP artifacts (e.g., `pcpcat`, `teampcp`, `xmrig`, `proxy.sh`, `kube.py`, `.pcpx`, `.pcp`) or hidden files (starting with a dot). This activity often indicates the initial staging or persistence mechanisms of the malware.
Detects the initial execution phase of the Phantom Gyp technique, which is used by the Miasma worm. This technique abuses the binding.gyp file with a command substitution pattern to execute a silent payload, bypassing standard npm lifecycle scripts.
Detects process execution indicative of the npm binding.gyp GYP shell expansion exploit used in the Miasma campaign to silently run node. This rule specifically looks for Node.js process executions with a command line matching a unique regex pattern associated with the exploit: 'node index.js > /dev/null 2>&1 && echo stub.c'.
Detects the execution of commands indicative of a user pasting a malicious script into the Terminal, often associated with ClickFix or fake CAPTCHA social engineering attacks. This typically involves using tools like `curl` to download and pipe payloads directly to a shell, or the use of `pbpaste` to execute clipboard contents.
This rule detects HTTP web requests where the URI contains the string "/bin/sh" (case-insensitive). This pattern is often indicative of an attempt to execute a Unix shell command via a web application, which could be part of a command injection attack (ATT&CK T1059.004).
Detects suspicious execution of the Bun runtime executing a JavaScript payload from the /tmp directory, matching the Miasma stage-four execution pattern. This rule specifically looks for the Bun executable running a JavaScript file named 'p<random>.js' within the /tmp directory, which is characteristic of the Miasma credential stealer.
This rule detects attempts to execute the Unix shell '/bin/bash' via HTTP requests. Specifically, it looks for the string '/bin/bash' within the URI of HTTP traffic flowing to the server. This could indicate an attacker attempting command injection or other web-based exploitation to gain shell access.
Detects the execution of curl on macOS using a hardcoded Catalina user agent (Mac OS X 10_15_7) and silent/fail-fast flags (-fsSL). This pattern correlates with the macOS terminal payload delivery mechanism used in the ClearFake/ClickFix campaign.
Scripting Interpreter Exec
Cortex XDR
This rule detects suspicious command execution patterns on Linux systems involving scripting interpreters. Specifically, it looks for these interpreters being invoked with command-line arguments that suggest direct execution of code. This pattern is commonly associated with web shell activity, reverse shells, or other forms of arbitrary code execution.
Detects an NGINX worker process spawning a shell or interpreter process, the post-exploitation primitive for CVE-2026-42945 (NGINX Rift). The exploit chain corrupts the ngx_pool_t cleanup handler and triggers system() with attacker-controlled shell commands, causing the nginx worker to fork /bin/sh with the -c flag. Since system() always invokes /bin/sh -c, the highest-fidelity match is nginx → /bin/sh -c <command>. Generalizes to catch arbitrary interpreter spawning (bash, python, perl, ruby, netcat variants, socat) which would result from any future post-exploitation pivot. Scoped to Linux because the exploit relies on the fork-based multi-worker architecture (Linux/BSD only). Windows nginx is not affected by the heap feng shui exploitation primitive.
Identifies package managers (like npm or yarn) executing suspiciously placed setup binaries from hidden or unconventional folders (e.g., tools/setup, .github/scripts/precheck) indicative of IronWorm preinstall hooks.
Detects the exploitation primitive of CVE-2026-3102 at the post-injection execution layer. The exploit succeeds when exiftool constructs a /usr/bin/setfile command line containing attacker-injected shell metacharacters (single quotes for command injection, backticks or $() for command substitution, semicolons for command chaining). Detecting setfile invocations spawned by exiftool with these characters in arguments is the smoking-gun signal. Even future variants of this vulnerability class (or related n-day exploits in the same family) would produce this same parent/child + metacharacter pattern.
Detects processes utilizing ${IFS} in conjunction with Base64 decoding. This technique is used by the Gogs argument injection exploit to bypass Git branch name space restrictions while delivering encoded shell payloads.
Detects `git rebase` commands containing the `--exec=` flag when spawned by a Gogs or Gitea server process. This activity is indicative of the exploitation of an argument injection vulnerability (CVE-2022-46153) in Gogs/Gitea, which allows an authenticated user to achieve Remote Code Execution (RCE) by creating a pull request with a specially crafted branch name. The rule specifically looks for `git` or `git.exe` processes executing `rebase` with `--exec=` and originating from `gogs`, `gitea`, or common shell processes that might be spawned by them.
Detects git rebase commands containing the `--exec=` flag, which is indicative of the argument injection vulnerability used to achieve RCE in Gogs. This rule specifically looks for the execution of 'git' or 'git.exe' with 'rebase' and '--exec=' in the command line.
Page 35 of 45