Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Detects the presence or execution of known TeamPCP malware and infrastructure tools (proxy.sh, kube.py, pcpcat.py, and tunneling tools like FRPS/gost) based on their MD5 file hashes. The group uses these standardized payloads to automate their operations.
This detection identifies suspicious command-line pipelines commonly used in "ClickFix" attacks. It specifically searches for the use of 'curl' or 'wget' to download a payload that is immediately executed via a shell, often hidden within a subshell `$(...)` or piped directly to an interpreter. This "download and execute" pattern is a high-fidelity indicator of a successful ClickFix lure, where a user has been tricked into running a malicious command.
This detection identifies a command-line pattern characteristic of "ClickFix" attacks on macOS. It looks for a shell process (like zsh, bash, sh) that is spawned by a known terminal application and executes a command involving echoing a string, decoding it with 'base64 -D', and piping it into another shell for execution. This technique is used by adversaries to trick users into running malicious code, bypassing standard OS protections.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
This detection identifies the use of the 'kill' command with a specific, non-standard real-time signal (-59). Rootkits like 'Singularity' use these 'magic' signals as an out-of-band communication channel to trigger actions within a malicious kernel module, such as toggling stealth features or granting root privileges.
This rule detects the execution of bash or sh scripts that contain specific keywords associated with the OpenClaw installation process. It looks for command lines that include "openclaw" along with other distinctive strings such as "run_remote_bash", "OPENCLAW_INSTALL_SH_NO_RUN", "OPENCLAW_USE_GUM", "All your chats, one OpenClaw", ".openclaw/openclaw.json", or "openclaw.ai/install.sh". This aims to identify potential OpenClaw installation attempts, even if the script itself has been renamed.
Detects the execution of a command pattern commonly associated with "ClickFix" social engineering attacks. This technique tricks users into pasting a command into their terminal, which typically uses 'echo' to pass a base64 encoded string to the 'base64' utility for decoding, and then pipes the output to a shell for execution. This method is used to bypass traditional OS-level protections like Gatekeeper and Notarization.
Detects potential reverse shell activity originating from a Grandstream VoIP device. This is a high-fidelity indicator of compromise following the successful exploitation of CVE-2026-2329. This version uses DeviceNetworkEvents.
Detects suspicious child processes (e.g., shells, network utilities) spawned by the Ivanti EPMM web server process (java, tomcat, httpd). This behavior is a strong indicator of successful remote code execution, often following the exploitation of vulnerabilities like CVE-2026-1281 and CVE-2026-1340.
This rule detects the execution of a bash or sh script that contains multiple identifiers related to OpenClaw installation. It specifically looks for command lines ending with '/bash' or '/sh' and containing 'openclaw', combined with additional OpenClaw-specific strings such as 'run_remote_bash', 'OPENCLAW_INSTALL_SH_NO_RUN', 'OPENCLAW_USE_GUM', 'All your chats, one OpenClaw', '.openclaw/openclaw.json', or 'openclaw.ai/install.sh'. This content-based detection aims to identify OpenClaw install script execution even if the script is renamed.
Detects when a known OpenClaw AI agent process executes commands associated with credential access or system discovery. This behavior can indicate a "0-click" prompt injection attack, where the agent is manipulated into executing malicious commands received through external data streams like emails or IM messages.
Detects exploitation of CVE-2026-25157 where the OpenClaw AI agent is manipulated to execute arbitrary commands via a malicious SSH target string. The vulnerability allows an attacker to inject command-line options like '-oProxyCommand' into the SSH client, leading to local command execution.
Detects when a known OpenClaw AI agent process spawns a shell to download and immediately execute a script. This is a common pattern used by malicious "Skills" to establish persistence or run further payloads, as detailed in the NSFOCUS report.
Detects a sequence of macOS system profiling and software update commands associated with the UNC1069 'ClickFix' social engineering ruse, often followed by a payload download via curl piped to a shell.
Detects high-risk command execution (e.g., curl, wget, ssh) originating from AI agent runtime processes like OpenClaw/ClawdBot. This behavior is associated with threat actors using backdoored 'skills' to exfiltrate data or move laterally.
Let's create a detection rule for "XONER dropper (multi-key
download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips,
xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner
xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips,
xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner
xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
Let's create a detection rule for "XONER dropper (multi-key download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
This rule detects attempts at command injection within the username field during authentication on Palo Alto firewalls. It specifically looks for patterns indicative of shell injection, including backtick-wrapped payloads (relevant to CVE-2024-9474), command separators like ';', '&&', '||', command substitution using '$()', directory traversal attempts ('../', './'), and the presence of common command-line utilities such as 'wget', 'curl', 'chmod', 'sh', 'bash', and 'nc' within the authentication message. The detection is based on system logs that record user authentication attempts.
Detects Bash /dev/tcp with HTTP request construction - high fidelity detection for payload download via raw sockets
Detects a command line pattern where `curl` is used to download a payload, which is then piped to `base64` for decoding and `gunzip` for decompression. This technique is commonly used by macOS infostealers like DigitStealer and MacSync to execute malware in memory without writing it to disk.
Detects the creation or modification of a `.vscode/tasks.json` file that is configured to automatically run a task when a folder is opened.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Page 39 of 45