Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects network connections from devices to known malicious infrastructure, specifically the domain 'sfrclak.com' or the IP address '142.11.206.73'. These indicators are associated with potential compromise or command and control activity.
Detects the creation of known malicious Remote Access Trojan (RAT) file artifacts on Windows, Linux, and macOS systems. These artifacts are associated with the plain-crypto-js@4.2.1 NPM package supply chain compromise, which dropped RAT payloads via a postinstall script. Specifically, it looks for 'wt.exe' in '%PROGRAMDATA%' on Windows, 'ld.py' in '/tmp/' on Linux, and 'com.apple.act.mond' in '/Library/Caches/' on macOS.
Detects known malicious file hashes associated with compromised axios npm package (RAT activity)
Detects creation of known malicious files linked to axios compromise
This rule detects the use of common utilities to transfer executable files (shell scripts, python scripts, perl scripts, or ELF binaries) between systems.
This detection rule identifies activities related to the TeamPCP Trivy supply chain compromise (CVE-2026-33634). It looks for specific indicators such as the presence of 'tpcp.tar.gz' in command lines, connections to the exfiltration domain 'scan.aquasecurtiy.org', access to '/proc/[pid]/mem' via command line, or the execution of 'sysmon.py' or 'systemctl' in suspicious contexts. A match indicates a strong reason for investigation, particularly in CI runner or developer environments, to confirm compromise and review follow-on activities.
This detection identifies network connections to specific malicious domains associated with the TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8). It specifically looks for connections originating from Python-related processes (python, python3, pip) to domains like 'models.litellm.cloud' or 'checkmarx.zone'. A match indicates potential compromise and warrants investigation into the affected host, user, and surrounding activity.
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
Detects the execution of the specific Linux payload path '/tmp/ld.py', commonly executed via python3 in the background by the dropper associated with the Axios npm supply chain attack.
The following analytic detects the execution of the 'gawk' command with elevated privileges on a Linux system. It leverages EDR telemetry to identify command-line execution data. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute system commands as root.
This rule detects DNS requests to the domain 'cloud.es.io'. This domain is associated with Elastic Cloud, and unusual traffic to it could indicate potential data exfiltration, command and control activity, or unauthorized access to Elastic Cloud resources. The rule specifically looks for the 'DnsRequest' event type in raw Falcon data and filters for the specified domain name, then outputs relevant host and network information.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects trojanized cron binaries that hide malicious cron jobs, with indicators resembling Perfctl
Detects the execution of a 'kubectl get secrets' command with specific parameters ('--all-namespaces', '-o json', '|| true') via a 'bash' process on Linux systems. This activity is indicative of bulk Kubernetes secret enumeration, a technique used by the TeamPCP stealer as described by Microsoft.
Detects the creation of specific log files (`ldapd*.1.gz`, `ldapd*.2.gz`) in the `/var/log/` directory. This behavior is indicative of the UNC3886 threat actor utilizing backdoored SSH clients and daemons to harvest and store XOR-encrypted credentials.
Detects a Python-initiated process attempting to read Google Cloud Platform (GCP) credentials by looking for command-line arguments containing 'GOOGLE_APPLICATION_CREDENTIALS' and 'cat 2>/dev/null'. This behavior is indicative of credential harvesting, potentially related to supply chain compromises like the Trivy incident.
Detects processes referencing confirmed TeamPCP C2 infrastructure or known malicious artifacts from the Trivy supply chain compromise. This includes specific C2 domains/IPs, temporary runner files, and a specific tarball name. It also looks for `entrypoint.sh` executing `grep` for environment variables or SSH-related strings, which could indicate credential access attempts.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects `curl` commands performing `POST` requests with `--data-binary` that are spawned from a process whose command line contains "trivy-action". This behavior is indicative of potential data exfiltration in the context of a compromised Trivy supply chain.
Detects malicious/suspicious systemd generator files for persistence mechanisms
This rule detects the creation of specific files associated with the TeamPCP malware's systemd persistence mechanism. It looks for the creation of '/.config/sysmon/sysmon.py' or '/.config/systemd/user/sysmon.service' which are used to maintain access and download further stages via C2 even if the original vulnerable litellm process terminates.
Page 291 of 347