Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Detects the modification of a `.vscode/settings.json` file to include a `PROMPT_COMMAND`. This technique allows an attacker to execute arbitrary commands every time a new terminal is opened in a Linux-based VS Code environment, such as GitHub Codespaces. It can be used for persistence or to exfiltrate credentials and secrets.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Detects the execution of automated Nginx configuration modification scripts by identifying the use of 'csplit', 'awk', or 'sed' in close proximity to Nginx service management commands (reload, restart, or testing). This pattern is a hallmark of the 'bt.sh', 'zdh.sh', and '4zdh.sh' toolkits used to inject malicious proxy_pass directives.
Detects when a Visual Studio Code process spawns a shell that immediately downloads and executes a script using a tool like `curl` and pipes it to a runtime like `node`. This indicates the abuse of `tasks.json` for code execution, a technique used by DPRK-linked actors.
Detects potential Sliver C2 implant activity on Linux systems based on process execution patterns, such as in-memory execution via memfd or process name masquerading from temporary directories.
Detects exploitation attempts of CVE-2025-42944, a critical insecure deserialization vulnerability in SAP NetWeaver AS Java RMI-P4 module. This rule identifies when SAP Java processes spawn system shells or execute suspicious commands, which is indicative of successful exploitation of the deserialization flaw. Attackers can exploit this vulnerability by sending malicious serialized Java objects to exposed RMI-P4 ports (typically 50004 or 50014), leading to arbitrary OS command execution with full system privileges. This pattern detects the post-exploitation behavior where the compromised Java process spawns interactive shells, creates scheduled tasks, or executes system commands.
This rule detects the multi-stage VoidLink C2 loader chain by identifying a combination of behaviors. It looks for fileless execution, specifically processes running from memory file descriptors or /proc/[pid]/fd paths. It also identifies kernel thread masquerading, where processes attempt to mimic legitimate kernel threads by using command lines like '[kworker/...]' or '[migration/...]' in conjunction with non-kernel executable paths. The rule further identifies staging activities, such as processes executing from common temporary directories like /tmp, /dev/shm, or /var/tmp. Additionally, it looks for specific VoidLink artifacts in command lines, including '.vl_', 'stage[0-9].bin', 'implant.bin', or C2 communication patterns like '/api/v2/(handshake|sync)'. Finally, it detects anonymous network activity, where a deleted executable (indicating fileless execution) is associated with network connection utilities like curl, wget, or socket/connect calls. The rule triggers when specific combinations of these behaviors are observed, such as fileless execution combined with kernel masquerading, or fileless execution combined with staging, or kernel masquerading combined with staging, or VoidLink artifacts combined with fileless execution or kernel masquerading, or anonymous network activity combined with kernel masquerading or staging. This correlation aims to reduce false positives by requiring multiple indicators of compromise.
Detects attempts to exploit the Apache bRPC heap profiler command injection vulnerability, CVE-2025-60021. This is done by monitoring for HTTP GET requests to the `/pprof/heap` endpoint where the `extra_options` parameter contains shell metacharacters indicative of an RCE attempt.
Detects various activities associated with the ShadowHS fileless Linux post-exploitation framework, including fileless execution, specific command-line patterns, covert exfiltration, and connections to known C2 infrastructure.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects the execution of a piped command chain typical of 'ClickFix' lures used by the MacSync infostealer. The malware tricks users into pasting a command into the terminal which uses curl to download a payload, decodes it with base64, and pipes it directly into a shell (zsh, sh) or osascript for execution, bypassing macOS security controls like Gatekeeper.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects the execution of the `iwpriv` utility by an unprivileged user targeting subcommands that are vulnerable to Local Privilege Escalation (LPE) in certain MediaTek Wi-Fi drivers. The exploitation of these vulnerabilities is demonstrated to be possible by unprivileged users, making the execution of kernel-level configuration tools like `iwpriv` by non-root users a highly suspicious activity.
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects exploitation of a remote code execution vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The attack involves an authentication bypass followed by the upload and execution of a malicious XSLT template, leading to command execution and potential web shell deployment.
Detects Indicators of Compromise (IOCs) associated with React2Shell (CVE-2025-55182) exploitation attempts. This includes network connections to known malicious IP addresses, DNS queries for attacker-controlled domains, process creations involving suspicious command-line arguments (often related to downloading or executing scripts/binaries), and file hashes of known malicious artifacts. The exploit activity is linked to C2 communication, data exfiltration, and potentially cryptomining activities.
Detects the creation of a persistent GitHub self-hosted runner named 'SHA1HULUD', a technique used by the Shai-Hulud 2.0 malware for persistence and remote command execution. The rule specifically looks for process command lines containing " --name SHA1HULUD".
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Page 40 of 45