Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects outbound network connections to the typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious Chromium extension masquerading as a 'Search for Perplexity AI' tool, which uses this domain for search-traffic interception and command-and-control (C2) exfiltration.
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.
Detects indicators of active exploitation or malicious activity targeting the Flowise application. The rule triggers on the creation of a 'flowise_marker.txt' file, the spawning of node processes with suspicious command-line flags ('--require', 'node_options') potentially intended to bypass security controls, and the execution of unexpected shell or scripting processes (cmd, bash, python, etc.) by a Flowise process.
Detects the use of 'osascript' to display credential prompts or 'dscl' with authentication-related arguments, which could indicate an attempt to phish user credentials or enumerate/create accounts on macOS systems.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
Detects attempts to access macOS Keychain items using 'osascript' executed from common shell processes. This activity can indicate an adversary attempting to steal credentials or other sensitive information stored in the Keychain.
Detects the use of 'rm' or 'unlink' commands to forcefully delete specific files or directories within the '/tmp' directory. The targeted files/directories ('osalogging.zip', '/tmp/sync', '/tmp/macsync_') could indicate cleanup activities after a malicious operation or system compromise, potentially related to macOS systems.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects instances where the FFmpeg or FFplay multimedia frameworks spawn unexpected child processes. This behavior is indicative of successful exploitation of the RASC/DLTA codec heap overflow vulnerability, where a malicious media file triggers arbitrary code execution.
Detects instances where Claude AI-related processes (claude, claude-code) or Node.js processes associated with Claude launch suspicious commands or scripts such as setup scripts, base64-encoded commands, shell interactions, or external network connections. This behavior is indicative of potential supply chain compromise or malicious use of AI-assisted coding tools to execute arbitrary system operations.
Detects the spawning of shell or scripting processes from IDEs, code editors, or AI-assistant processes (e.g., 'claude', 'node'). The rule specifically flags potential reverse shell patterns or dangerous command-line flags often used during development or exploitation, such as '--dangerously-skip-permissions'.
This rule detects when the node.exe process initiates an outbound network connection to a specific set of non-standard, often high-numbered ports (8443, 8445, 8453, 5555, 56001-56003) over the public internet. This behavior is often indicative of potential command and control (C2) communication, reverse shells, or malicious scripts executing within a Node.js runtime environment.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Detects instances where code editors like Cursor or Claude execute shell commands or CLI tools often used for configuration, network activity, or credential interaction. This pattern may indicate malicious exploitation of editor configuration files (e.g., MCP configuration) or unauthorized use of the editor environment to execute shell commands.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Page 115 of 174