Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,266 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,028
2,539
1,076
1,048
928
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,335
1,318
902
884
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects an npm or pip package installation process spawning a script
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
Detects execution of the XMRig Monero cryptominer or a miner
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects the AnyDesk Linux service running as root spawning a shell process (sh, bash, dash, zsh) or executing a command associated with the AnyPwn (CVE-2025-27918) post-exploitation behavior.
Detects SSH clients launched with reverse (-R) or dynamic (-D) port
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
Detects creation of a new local administrative account on or through a
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects the usage of command-line flags in AI coding assistant CLIs (such as Claude Code, Amazon Q CLI, and others) that intentionally skip security permissions, bypass approvals, or disable sandbox protections. The rule identifies potential developer activity that may inadvertently reduce the security posture of the development environment.
Detects instances where package managers (pacman, makepkg, yay, paru) or their children spawn a root shell that downloads and executes external scripts via curl or wget.
Detects modification or creation of .htaccess files within WordPress directory structures followed within 24 hours by the creation or modification of .cache files in the same directory. This behavioral pattern is often indicative of web shell deployment or persistence installation via compromised web applications.
Sweeps DNS, endpoint network and proxy/firewall telemetry for BraZetsu C2, panel and shop domains using exact or subdomain matching. The apex installscenter.com remains active on Cloudflare with wildcard certificates.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Summarizes the count of devices grouped by their manufacturer and model from device inventory or telemetry data.
Summarizes the count of devices by CPU manufacturer and architecture using Kusto Query Language (KQL).
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Page 13 of 346