Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,645 detections
Filters
Last updated
All Time
Detection languages
1,768
374
349
273
255
Contributors
908
676
593
359
164
Categories
1,500
1,168
781
528
521
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
807
512
432
340
300
MITRE Techniques
1,179
581
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Detects network connections to the npm registry (registry.npmjs.org) initiated by AI coding agent processes (such as Claude, Cursor, Copilot, Windsurf, Codeium, Aider) or by unexpected processes that are not standard package managers or browsers.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Detects endpoint network connections and correlates multi-stage communications associated with the ClickFix browser cache smuggling campaign, including initial payload retrieval and secondary stage/C2 communication across devices.
Detects outdated or vulnerable installations of GitLab and Ruby across devices using TVM software inventory, software vulnerabilities, process events, and file events, checking against known fixed versions for specific CVEs.
Detects DNS requests to major generative AI and Large Language Model API endpoints (such as OpenAI, Anthropic, Google Gemini, Mistral, Groq, DeepSeek, and others) initiated by processes other than standard web browsers (e.g., chrome, msedge, firefox, safari). This behavior may indicate unauthorized data exfiltration, shadow AI usage, or automated tooling/scripts interacting with LLM APIs.
Detects suspicious Ghostscript execution patterns where Python spawns Ghostscript with dangerous I/O pipe arguments or disabled SAFER mode, or where Ghostscript spawns shell interpreters.
Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.
Detects the execution of PaperCut reverse SOCKS5 bridge kit operator-side scripts (such as admin_bridge.py, live_reverse_socks5.py, start_socks.sh) or the creation of related Java bridge class artifacts.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects outbound IPv4 and IPv6 connections from endpoints to public IP addresses on high-numbered ports (1023 and above), excluding private, reserved IP ranges and known noisy processes. Command-and-control tools, malware and tunneling activities may use uncommon ports to evade network monitoring.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects the execution of the public Horizon3.ai PoC exploit for CVE-2026-106173 (FortiSIEM gRPC path traversal RCE) utilizing python interpreters with specific command-line arguments indicative of the exploit tool.
Detects the execution of administrative commands and scripting interpreters spawned by the VMware Tools daemon (vmtoolsd), which may indicate an adversary leveraging ESXi guest operations for remote code execution.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Detects modifications to the Tor configuration file (torrc) that permit SSH traffic (port 22) in the exit policy, followed by a Tor service reload or restart on the same device within a 4-hour window. This behavior may indicate an adversary setting up an onion routing proxy or covert tunnel.
Page 2 of 174