Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects the upload and execution of a specific malicious CSV file (evil_tenant.csv) on Cisco SD-WAN Manager (vManage) systems. This file is associated with exploitation of CVE-2026-20245, enabling attackers to inject a persistent root backdoor account into the system files.
Detects the execution of common system enumeration commands (process listing, network configuration, and system information) on Cisco SD-WAN infrastructure nodes. This activity is indicative of post-exploitation reconnaissance used by attackers to understand the system environment, network topology, and identify potential pivot points within the SD-WAN infrastructure.
Detects AI-powered development tools like Claude Code (running via node) spawning shell interpreters, executing common setup/configuration scripts, or invoking network utilities during project initialization. This activity is indicative of indirect prompt injection attacks where an adversary lures an AI agent into executing malicious code from a repository.
Detects instances where language-related processes (amazonq-language-server, node) or common tools (bash, sh, curl, aws) execute commands containing AWS access credentials or perform potential data exfiltration via curl POST requests.
Detects execution patterns associated with CVE-2026-46331 (pedit COW exploit), which uses a user namespace unshare operation, followed by tc pedit action abuse to perform page cache poisoning on /bin/su to achieve root privilege escalation. The rule monitors for the exploit binary, unshare namespace creation, tc command interaction, unauthorized root shell spawning by su/sudo, and attempts to clear page caches.
Detects the execution of Dropbear SSH binaries (dropbear, dropbearkey, dropbearmulti) on identified OT, ICS, or SCADA assets. The rule flags suspicious configurations such as the use of non-standard ports (2222, 44818), remote port forwarding, or running in the foreground, which may indicate unauthorized remote access or tunneling on sensitive operational technology infrastructure.
Detects evidence of active exploitation targeting the libarchive ZIP entry declared-vs-actual size boundary vulnerability. The rule identifies the execution of known proof-of-concept (PoC) scripts (make_debuginfod_zip.py, run_stock_marker.py) as well as the creation of specific marker files or CLI output from bsdunzip/bsdtar that confirm successful boundary exploitation.
Detects the use of 'sshpass' with disabled host key checking ('StrictHostKeyChecking=no') to automate SSH connections. The rule specifically targets command lines referencing administrative accounts ('psoft', 'oracle', 'linuxadm'), a technique associated with ShinyHunters lateral movement activity.
Detects the exploitation chain of the DirtyClone (CVE-2026-43503) vulnerability on Linux systems. The rule monitors for a sequence involving an unprivileged user (UID > 1000) creating a new user/network namespace, configuring an IPsec XFRM state with loopback source/destination addresses, modifying sensitive memory via /proc/self/mem or /proc/<pid>/mem to bypass Copy-on-Write (CoW) protections, and ultimately spawning a process with root privileges.
Detects a multi-stage attack sequence where a web-facing application (e.g., Python, Node.js) downloads a file to a temporary directory (/tmp or /var/tmp) using curl or wget, creates the file, and subsequently applies executable permissions (chmod +x) to it. This pattern is characteristic of CVE-2026-33017 exploitation targeting Langflow to deploy cryptomining binaries.
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Detects reconnaissance activities targeting binaries or modules containing libssh2 library references or specific PHP symbol offsets (e.g., zend_execute_internal, zif_system). This rule monitors for common administrative and debugging tools like ldd, strings, readelf, and nm being used to scan files for sensitive symbols or version information, as well as specific PHP enumeration patterns and validation script executions, which are commonly associated with the triage process for CVE-2026-55200.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
This rule detects the exploitation of CVE-2026-20245 on Cisco SD-WAN Manager (vManage). It monitors for two distinct phases: 1) The suspicious upload of a tenant-list CSV file via CLI using a malicious filename, and 2) A subsequent privilege escalation attempt where the 'admin' user executes 'su' to switch to a 'troot' user, which is indicative of a backdoor account creation following successful exploitation.
This rule detects attempts to authenticate to SSH using GSSAPI (Generic Security Service Application Programming Interface). While GSSAPI can be used for legitimate authentication, its presence in logs might indicate an attacker attempting to use alternative authentication methods, potentially for lateral movement or privilege escalation, especially if unexpected in the environment.
This rule detects successful SSH authentications using the GSSAPI-with-MIC mechanism. This can indicate legitimate user logins or, in some cases, an adversary using valid credentials to access a system via SSH.
Detects non-root users utilizing the 'tc' or 'ip' utilities to interact with kernel traffic control structures (qdisc/filter/action) specifically involving 'pedit' actions. This activity is a documented prerequisite for exploiting CVE-2026-46331, a vulnerability enabling page cache poisoning and local privilege escalation.
Detects unauthorized modifications to FreeBSD init scripts located in /etc/rc.d/, /usr/local/etc/rc.d/, or /etc/rc.subr. These directories are used for system service startup. The rule specifically monitors for modifications related to the BRICKSTORM persistence mechanism, which targets these scripts to execute malicious binaries such as /usr/local/libexec/ipsec/blacklist.
This rule detects various stages of exploitation associated with the CVE-2026-45257 'BUMSRAKETE' vulnerability, which targets FreeBSD kernels. It monitors for the execution of exploit binaries, compilation of source code related to the exploit, the presence of specific staging files in temporary directories, and the subsequent spawning of shells by the exploit process. It also identifies command-line arguments indicative of BUMSRAKETE activity.
Detects reconnaissance activity where an attacker executes system discovery commands to identify the FreeBSD kernel version and kTLS configuration (specifically 'kern.ipc.mb_use_ext_pgs'). This enumeration is performed to fingerprint potential targets for the BUMSRAKETE exploit (CVE-2026-45257).
Detects a Perl-based SOCKS proxy used by the threat actor Velvet Ant that masquerades as the legitimate smbd process by running with 'smbd -D' command line arguments while listening on non-standard port 5000.
Page 30 of 51