Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,266 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,028
2,539
1,076
1,048
928
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,335
1,318
902
884
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects creation of sitecustomize.py, usercustomize.py, or .pth path configuration files inside a site-packages or dist-packages directory by a python or pip process. These files are automatically loaded by Python's site module on every subsequent interpreter start, allowing a malicious package installer to establish persistence that re-executes on every future Python invocation without further victim interaction.
Detects execution of the XMRig Monero cryptominer or a miner
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
Detects creation of a JSP/JSPX/WAR server-side script inside
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects the use of system utilities (wevtutil, PowerShell, wmic, etc.) or log-reading tools (grep, tail) for log enumeration or export when executed by processes that are not standard management or monitoring agents. This pattern is commonly associated with adversary efforts to gain situational awareness or identify security logs.
Detects when an SAP process opens an FTP session to a host that is not on the approved server list.
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated promptly.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Detects the use of curl or wget commands targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 for credential theft, or performing file uploads and data exfiltration patterns.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps endpoint and firewall telemetry for connections to the two high-confidence BraZetsu infrastructure IPs. Review hits against the IP's first-seen date before blocking because the Njalla host has changed service.
Sweeps endpoint and firewall telemetry for connections to the two high-confidence BraZetsu infrastructure IPs. Review hits against the IP's first-seen date before blocking because the Njalla host has changed service.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps DNS, endpoint network and proxy/firewall telemetry for BraZetsu C2, panel and shop domains using exact or subdomain matching. The apex installscenter.com remains active on Cloudflare with wildcard certificates.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects anomalous process execution and loopback network activity associated with the Model Context Protocol (MCP) 'exec_in_session' method. This pattern indicates an adversary potentially abusing the AI coding assistant's MCP server capabilities to execute arbitrary commands as a C2 channel.
Detects the creation or modification of Python configuration files (.pth, sitecustomize.py, usercustomize.py) within site-packages or dist-packages directories when not initiated by recognized Python package managers. Such files can be abused to achieve arbitrary code execution upon Python interpreter startup, a common method for persistence or local privilege escalation in Python environments.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Page 16 of 346