Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of iptables commands used for Single Packet Authorization (SPA), a technique observed being used by UNC6201. This rule identifies when iptables is configured to inspect traffic on port 443 for a specific hex string, which is a key component of the actor's C2 proxying tradecraft.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Detects unauthorized interactive modifications to CI/CD pipeline configurations that could indicate supply chain attack or malicious dependency code injection attempts.
Upx Packer
YARA
Generic detection for UPX packer
Detects an adversary stopping or killing the syslog daemon (syslog,
rsyslog, or syslog-ng), which is responsible for forwarding system
events to /var/log and to SIEM collectors.
Stopping the syslog daemon is distinct from clearing existing logs --
it cuts the live telemetry pipeline at the source. Any activity
occurring after the daemon is stopped produces no log records
whatsoever, creating a blind spot.
rsyslog, or syslog-ng), which is responsible for forwarding system
events to /var/log and to SIEM collectors.
Stopping the syslog daemon is distinct from clearing existing logs --
it cuts the live telemetry pipeline at the source. Any activity
occurring after the daemon is stopped produces no log records
whatsoever, creating a blind spot.
Detects when a known OpenClaw AI agent process executes commands associated with credential access or system discovery. This behavior can indicate a "0-click" prompt injection attack, where the agent is manipulated into executing malicious commands received through external data streams like emails or IM messages.
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
This rule looks for the use of common interpeters in the context of editing binary login files.
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
This rule looks for the use of common interpeters in the context of editing binary login files.
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
Detects multiple methods used by adversaries to clear or disable Linux
shell command history (bash, zsh) in order to cover tracks and evade investigation.
shell command history (bash, zsh) in order to cover tracks and evade investigation.
Detects outbound network traffic to known infrastructure used in OpenClaw malicious skill delivery or credential exfiltration. These IOCs were identified in the NSFOCUS report on OpenClaw security risks.
Detects methods used by adversaries to clear or disable Linux shell command history (bash or zsh) in order to cover tracks and evade investigation.
Detects exploitation of CVE-2026-25157 where the OpenClaw AI agent is manipulated to execute arbitrary commands via a malicious SSH target string. The vulnerability allows an attacker to inject command-line options like '-oProxyCommand' into the SSH client, leading to local command execution.
Detects when a known OpenClaw AI agent process spawns a shell to download and immediately execute a script. This is a common pattern used by malicious "Skills" to establish persistence or run further payloads, as detailed in the NSFOCUS report.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects the modification or deletion of specific JavaScript or Python files shortly after a Node.js or Python interpreter starts. This behavior is characteristic of the 'self-patching' and 'evidence removal' techniques used by the Lazarus Group's Graphalgo malware.
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects exploitation of CVE-2026-24061, an authentication bypass in GNU telnetd, where the 'login' process is spawned with the '-f' flag to skip authentication and gain root access.
Detects logs cleared in MacOS systems
Detects the creation of a 'startup.js' file in specific, non-standard subdirectories used by the Lazarus Group's 'Graphalgo' campaign to stage malicious payloads. These paths mimic legitimate application folders to evade detection.
Detects the creation of a JavaScript file in unusual subdirectories of the Google Chrome user data or application support folders. This behavior was observed in the 'graphalgo' campaign by the Lazarus Group to stage second-stage payloads.
This rule detects the execution of command-line interpreters (bash, powershell, cmd, python) that include commands for invoking expressions or downloading content (invoke-expression, curl, wget, Invoke-WebRequest) AND contain specific keywords associated with AI agents (moltbot, openclaw, clawdbot). This combination suggests an AI agent potentially executing arbitrary or malicious commands, possibly as a result of prompt injection or an unusual script execution scenario.
Page 302 of 347