Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects a sequence where a device exhibits Remote Monitoring and Management (RMM) tool execution followed by high-volume outbound network connections to consumer cloud storage services (such as OneDrive or Google Drive) from the same device, potentially indicating data exfiltration via RMM.
Detects a PowerShell download-and-execute command referencing specific typosquatted lure domains (e.g., choclatey.org, massgravel.net) combined with follow-up script activity writing into a fake SystemHealth\Update directory.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects modifications to the Tor configuration file (torrc) that permit SSH traffic (port 22) in the exit policy, followed by a Tor service reload or restart on the same device within a 4-hour window. This behavior may indicate an adversary setting up an onion routing proxy or covert tunnel.
Detects outbound network connections from processes targeting a known hard-coded Potassium campaign C2 IP address (134.199.154.64), followed by fallback DNS resolver queries using standard public DNS servers by the same process.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects googleupdate.exe loading an unsigned DLL from a non-standard path, followed by network communication to a known Command and Control (C2) domain or IP address.
Detects non-browser processes contacting multiple distinct cloud storage APIs within a one-hour timeframe, a pattern indicative of potential multi-service command and control or data exfiltration.
Detects a process with no prior AI API activity in the past 14 days suddenly generating a high volume (200+ calls) of network connections to public AI inference endpoints (OpenAI, Anthropic, Grok, OpenRouter). This behavior is consistent with stolen API keys being used to drain resources or exfiltrate data from a newly compromised host.
Box Shield Malicious Content Upload
Cortex XDR
Surfaces Box Shield malware detection alerts with file hash, upload path, source IP, and scan results for immediate correlation and threat response.
Detects a sequence where PowerShell or PWSH executes a web download referencing an .mp4 file using download cmdlets, followed within 1 hour by the execution of NetSupport Manager components (client32.exe or pcictlui.exe) from a user-writable path.
Detects the download of potentially suspicious executables, scripts, or archives originating from code hosting platforms like GitHub, GitLab, and various mirrors where files have low prevalence and lack valid signatures.
Detects newly seen devices (no Tailscale process activity in the prior 30 days) executing Tailscale enrollment or login commands followed by outbound network connections to Tailscale control infrastructure within 10 minutes, potentially indicating unauthorized VPN tunneling.
Detects execution of Node.js or Bun from a temporary directory performing DNS queries for public Ethereum JSON-RPC provider domains, a technique observed in supply chain compromise payloads such as Shai-Hulud and ChainDrop to resolve command and control endpoints.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects host-side telemetry indicating Cairn agent worker artifacts, including specific process command line terms, tsec skill files and environment variables, combined with network connections to OpenRouter from the same host.
Detects the execution of NetSupport Manager client binaries (client32.exe or pcictlui.exe) from user-writable directories such as AppData, ProgramData, or Public folders, optionally spawned by script loaders or command interpreters.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Page 4 of 297