Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,670
9,758
6,693
4,421
3,749
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
Detects HTTP requests that use URL-encoded backslash traversal sequences
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects the presence of known artifacts associated with the GhostContainer backdoor, including indicators of Neo-reGeorg web shell usage, ysoserial payloads, and exploitation attempts targeting the CVE-2020-0688 vulnerability via VIEWSTATE manipulation.
Detects indicators of the Bazinga macOS backdoor and Polygon-C2 campaign, including specific command-and-control domains, C2 infrastructure IP addresses, persistence mechanisms via launch agent property lists, and associated cryptographic indicators like file hashes and wallet addresses.
Detects instances where the IIS worker process (w3wp.exe) spawns common command-line or system utilities often used for post-exploitation activities, specifically when command-line arguments contain references to 'MSExchange' or 'Exchange'. This behavior is frequently associated with exploitation attempts against Microsoft Exchange servers, such as the ProxyLogon chain, where a web shell or other malicious script might be used to execute commands via the IIS process.
The following analytic identifies unusually long strings in the Content-Type HTTP header sent by the client to the server. It uses data from the Stream:HTTP source, specifically evaluating the length of the `cs_content_type` field. This activity is significant because excessively long Content-Type headers can indicate attempts to exploit vulnerabilities or evade detection mechanisms. If confirmed malicious, this behavior could allow attackers to execute code, manipulate data, or bypass security controls, potentially leading to unauthorized access or data breaches.
Detects post-exploitation shell activity spawned from the IIS worker process (w3wp.exe), narrowed to command lines carrying encoded/obfuscated PowerShell flags, remote-download cradles, or basic recon/persistence commands (whoami, certutil, bitsadmin, schtasks, reg add). This reduces noise from benign w3wp.exe-initiated automation while retaining the behavioral pattern seen in the Telerik UI for ASP.NET AJAX unauthenticated RCE chain (webshell/in-memory DLL execution dropping to a shell).
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
Page 10 of 58