Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects the execution of PaperCut reverse SOCKS5 bridge kit operator-side scripts (such as admin_bridge.py, live_reverse_socks5.py, start_socks.sh) or the creation of related Java bridge class artifacts.
Detects malicious behaviors involving the Chisel tunneling tool, including reverse SOCKS proxy connections with TLS verification skipped, cron-based persistence referencing watchdog scripts in hidden /var/tmp directories, and associated tool staging activities.
Detects web server processes (apache2, httpd) spawning a Unix shell (sh, dash, bash) which subsequently executes curl, wget, or php to perform an external HTTP fetch or download. This behavior is commonly associated with PHP or web application post-exploitation callbacks (webshells).
Detects when AI coding agent processes (such as Claude, Cursor, Copilot, Windsurf, Codeium, or Aider) spawn command shells or download utilities with command lines indicative of downloading and executing external payloads.
Detects outbound IPv4 and IPv6 connections from endpoints to public IP addresses on high-numbered ports (1023 and above), excluding private, reserved IP ranges and known noisy processes. Command-and-control tools, malware and tunneling activities may use uncommon ports to evade network monitoring.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Detects cmd.exe launched from the Windows Run dialog (explorer.exe
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings.
It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.
This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.
This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
Detects the setting of the TS_SERVE_ALLOW_ALL_INTERFACES environment variable or registry key combined with the execution of Tailscale serve or funnel commands on the same device within a 24-hour window, potentially indicating unauthorized exposure of local services.
Detects PowerShell using System.Net.WebClient DownloadFile or related commands to fetch tool dependencies (such as 7z, MSTSCLib, ffmpeg) from GitHub repositories associated with the 'websalat' naming convention, indicative of Salat Stealer or similar tool-loading activity.
Detects GitLab backend processes (such as puma, sidekiq, rails, ruby, bundle) spawning shells, scripting interpreters, or network tools with suspicious command-line parameters, potentially indicating post-exploitation activity or vulnerability exploitation.
Detects the creation of AI coding assistant configuration files (such as .cursorrules, CLAUDE.md) in user directories (Downloads, Desktop, Temp) by non-git processes, followed within a short time window by execution of interpreters or tools (like node, npm, powershell, cmd, curl) with suspicious command line parameters indicating possible download or script execution.
Detects web server processes (Apache httpd, apache2, php-cgi, php-fpm) spawning a Unix shell (sh, bash, dash) that executes a wget or curl command piped directly into the shell for execution, indicative of potential remote code execution or web shell activity.
Detects multiple distinct source IPs sending forged 'pitboss PPE' authentication failure messages to NetScaler authentication endpoints within a short timeframe, associated with a fetch-based FreeBSD payload download (kw2-freebsd-x64-s11).
Detects execution and network activity associated with the cache_base operator toolkit, including JuicyPotatoNG (kitanai.exe), RegPwn (nandemo.exe), ufw.exe reverse shell, and upd-ms.bat launching these tools with connections to *.strangled.net on port 7070.
Detects sandbox or training hosts performing DNS resolution followed shortly by outbound connections to public IP addresses on ports 80 or 443, which may indicate a firewall misconfiguration or unauthorized egress from isolated environments.
Detects potential DLL sideloading of mscoree.dll outside of standard system and .NET paths, followed closely by network activity connecting to GitHub from the same process within a one-hour window.
Detects the execution of unapproved Remote Monitoring and Management (RMM) software tools followed by subsequent outbound public IP network activity from the same process on the same device, indicating an active remote session.
Detects the execution of Remote Monitoring and Management (RMM) tools followed closely (within 1 day) by potential data exfiltration activity using tools like WinSCP or Rclone, or connections to cloud storage providers (OneDrive, Google Drive) from the same device.
Detects the correlation of remote execution tools (such as PsExec, WinRM, or specific PowerShell remote execution commands) with RDP or ScreenConnect remote management activity on the same device within a one-hour window, potentially indicating lateral movement or unauthorized remote control.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Page 3 of 297