Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
This rule detects the multi-stage installation and command-and-control (C2) activities associated with GhostClaw or GhostLoader malware on macOS systems. It correlates suspicious process executions, such as curl-based bootstrap, install.sh execution, user-space Node.js setup, and outbound network traffic to 'trackpipe.dev' with UUID-like pathing or specific NODE_CHANNEL values. The rule looks for a combination of at least three of these indicators within a two-hour window to reduce false positives.
Detects SessionReaper webshell activity on Magento e-commerce platforms, including process execution from suspicious media directories.
Detects the execution of cat, followed by network connections. Specifically /dev/tcp/ redirection
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects execution of shell scripts from mounted disk images (DMG), a technique
used to bypass Gatekeeper restrictions after macOS Sequoia updates.
used to bypass Gatekeeper restrictions after macOS Sequoia updates.
Detects the complete CVE-2026-21902 exploitation chain against Juniper Junos OS Evolved On-Box Anomaly Detection Framework. Requires all four steps: command creation, DAG creation, DAG instance scheduling, and commit.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
This detection is designed to help you find activity related to BRICKSTORM espionage backdoor (appliances/vCenter). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
This rule detects activity related to OpenClaw, Clawdbot, and Moltbot, including their known aliases (clawd, molty, clawhub). Detection is based on several indicators: specific command-line arguments used with common scripting/execution environments (node, npm, bun, pnpm, bash, sh, zsh, launchd, env, curl, pwsh, powershell), presence of specific install or data directories (e.openclaw, .moltbot, .clawdbot, /clawd/, .molty), macOS LaunchAgent persistence mechanisms (ai.openclaw.gateway.plist, bot.molt., com.openclaw.gateway.plist, /Applications/OpenClaw.app), and the use of specific configuration file names (openclaw.json, moltbot.json, clawdbot.json, clawd.json) or aliases (molty, clawhub) within process display names or names.
This rule detects the execution of PHP with command-line arguments indicative of web shells like 'aws.php' and 'file_save.php', which have been used in the exploitation of CVE-2026-1731. The detection looks for the use of eval with base64 decoding and specific, non-standard parameters used to pass commands.
Detects a command that downloads remote content and immediately runs it with bash. This is a common way to run attacker controlled code on a Linux host.
Detects a pattern associated with the 'ClawHavoc' campaign where processes related to the OpenClaw AI framework download and immediately execute content from the internet. This is often seen in malicious 'prerequisite' or 'setup' scripts exploiting CVE-2026-25253.
Detects the execution of a shell command that decodes a base64 string and pipes the output directly into another shell for execution. This is a common obfuscation technique used by malware, including the AMOS stealer dropper delivered via malicious OpenClaw skills, to hide the initial payload.
This rule detects the execution of install scripts associated with 'OpenClaw' or 'Clawdbot' via various command-line interpreters. It specifically looks for commands involving 'curl', 'wget', 'bash', 'sh', 'zsh', 'pwsh', 'powershell', 'node', or 'npm' that contain specific URLs or package names related to the installation of these tools. This includes shell scripts like 'install.sh', 'install-cli.sh', PowerShell scripts like 'install.ps1', and npm installations like 'npm install -g openclaw'.
Detects a process with a short, alphanumeric filename executing from the /var/tmp/ directory and spawning a shell. This behavior is associated with the GRIDTIDE backdoor, which uses this technique for post-compromise reconnaissance and execution.
Detects curl or wget download followed by chmod and execution, consistent with staged malware delivery used by malicious OpenClaw skills distributing AMOS.
Detects the execution of specific Asterisk CLI commands, often associated with reconnaissance or resource hijacking, by non-interactive or web server accounts. This behavior is a key indicator of the EncystPHP web shell abusing PBX functionality for activities like toll fraud.
Detects Base64 decoded content being executed via a shell on macOS, consistent with malicious OpenClaw skill style obfuscated command execution.
Detects the Claude CLI or Claude Code spawning suspicious child processes such as shells or network utilities. This behavior indicates exploitation of malicious hooks or MCP server configurations executing arbitrary commands, as seen in CVE-2025-59536 and CVE-2026-21852.
Detects when the BeyondTrust remote support client process ('bomgar-scc.exe' or 'bomgar-scc') spawns a shell or a common reconnaissance/downloader tool. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2026-1731, where an attacker gains code execution and begins to explore the compromised system.
Page 38 of 45