Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects a process running with a name that mimics a Linux kernel worker thread (e.g., 'kworker/...') but is not running as the root user. This is a known masquerading technique used by malware such as ClipXDaemon to evade detection.
Detects the modification of the .profile file to establish persistence, a technique used by the ClipXDaemon malware. The rule looks for a command that appends the execution of a file from the `~/.local/bin` directory to the `.profile` file.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
Detects processes masquerading as kernel worker threads (e.g., 'kworker/*') but running in a non-root user context. This technique is used by the ClipXDaemon malware to evade detection by blending in with legitimate system processes.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
This rule detects the execution of a process that attempts to build an executable using 'zig build-exe' and subsequently initiates a process with a command line containing 'https://github.com/nullclaw/nullclaw.git'. This could indicate an adversary building a malicious executable on a host and then attempting to download or interact with a malicious GitHub repository, potentially for further stages of an attack.
This rule detects potential indicators of compromise related to CVE-2026-20127 in Cisco Catalyst SD-WAN systems. It focuses on two main areas: 1) suspicious successful SSH authentications for the 'vmanage-admin' account, and 2) SD-WAN control plane connection events indicating a new 'up' state. The first part looks for specific log entries related to publickey authentication for 'vmanage-admin' from any source IP. The second part identifies control connection state changes to 'up' and extracts peer type, peer system IP, and public IP from the raw logs. The rule aims to surface events that require human confirmation by comparing them against known network designs and change records, as these events can indicate unexpected relationships between devices or unauthorized privileged access.
Detects active SSH session takeover attempts.
When the process of one user accesses another user's SSH agent
When the process of one user accesses another user's SSH agent
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.
Monitors for command-line activity indicating the addition of SSH keys to authorized_keys files or the modification of the SSH daemon configuration to permit root login on Cisco SD-WAN devices. This is a common persistence technique used by attackers after gaining initial access, such as through CVE-2026-20127.
Detects the creation or modification of Python scripts in the /unitree/etc/programming/ directory on Unitree Go2 robots. This activity is a strong indicator of exploitation of CVE-2026-27509 or CVE-2026-27510, where an attacker uploads a malicious script for remote code execution.
This hunting query searches Defender XDR telemetry for activity consistent with the GRIDTIDE campaign by combining network, process, and file-based indicators. It identifies endpoint connections to published campaign infrastructure, including known IP addresses and dynamic DNS-style domains. It also looks for direct access to Google Sheets API endpoints and parameters described as part of the actor’s command-and-control workflow, particularly when the initiating process is not a normal web browser. In addition, it checks for file and process indicators associated with reported GRIDTIDE artefacts by matching published SHA-256 hashes and common artefact filenames. Results are returned as a unified view with a match type label to help triage whether the alert is driven by network IOC matches, Google Sheets API usage, or host artefact indicators.
Detects the deletion or clearing of critical Cisco SD-WAN log files. This is a common post-exploitation technique used by attackers to cover their tracks after compromising a device, for instance, after exploiting CVE-2026-20127. The rule identifies direct file deletions and commands used to clear or truncate log file content.
Detects broad filesystem searches using native OS commands ('dir' on Windows, 'find' on Linux/macOS) for files containing sensitive developer information like private keys, mnemonic phrases, and configuration files. This TTP is used by modules 5 and 6 of the StegaBin toolkit.
Detects the creation or modification of a Claude Code settings file (`.claude/settings.json`). This file can be configured to automatically approve Model Context Protocol (MCP) servers by setting `enableAllProjectMcpServers` to `true` or by using `enabledMcpjsonServers`. This bypasses security prompts designed to warn users about potential command execution, which can lead to Remote Code Execution (RCE) as described in CVE-2025-59536.
Detects network connections from the Claude Code CLI ('claude' or 'claude.exe') to a destination other than the official 'api.anthropic.com' endpoint. This indicates that the 'ANTHROPIC_BASE_URL' environment variable has likely been overridden by a malicious '.claude/settings.json' configuration file in an attempt to intercept and exfiltrate API keys, as described in CVE-2026-21852.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
Detects active SSH session takeover attempts.
Watching for common terminal multiplexing utilities attaching to sessions.
Watching for common terminal multiplexing utilities attaching to sessions.
Detects attempts to disable or stop syslog services (syslog, rsyslog, syslog-ng) using common system utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses by preventing logging of their actions.
Page 296 of 347