Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,645 detections
Filters
Last updated
All Time
Detection languages
1,768
374
349
273
255
Contributors
908
676
593
359
164
Categories
1,500
1,168
781
528
521
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
807
512
432
340
300
MITRE Techniques
1,179
581
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Identifies devices that have been enrolled within the last 30 days, displaying details such as device name, model, enrollment profile name, and enrollment date.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects the usage of command-line flags in AI coding assistant CLIs (such as Claude Code, Amazon Q CLI, and others) that intentionally skip security permissions, bypass approvals, or disable sandbox protections. The rule identifies potential developer activity that may inadvertently reduce the security posture of the development environment.
Sweeps DNS, endpoint network and proxy/firewall telemetry for BraZetsu C2, panel and shop domains using exact or subdomain matching. The apex installscenter.com remains active on Cloudflare with wildcard certificates.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Summarizes the count of devices grouped by their manufacturer and model from device inventory or telemetry data.
Summarizes the count of devices by CPU manufacturer and architecture using Kusto Query Language (KQL).
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Detects the Shai-Hulud tensorlake payload pattern of fetching a platform-specific HackBrowserData binary and then executing it on the same host to dump browser-stored credentials. Anchored on tool behavior (download then execution on one host) rather than a single sample hash or the rotating C2 domain.
Detects the creation of persistence artifacts associated with the 'gh-token-monitor' service utilized by the Shai-Hulud worm across Linux systemd user services, macOS LaunchAgents, and Windows scheduled tasks or local application directories. This service acts as a dead-man's switch designed to wipe the user's home directory if the stolen GitHub token is revoked.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects potential exploitation of the libcurl CURLOPT_REQUEST_TARGET CRLF injection vulnerability via web/proxy request logs where curl user-agents are observed with carriage return/line feed characters or injected request lines within the URI path.
Detects process execution where a shell (such as bash, zsh, cmd, or powershell) is spawned by a skill or openclaw process, and subsequently performs download activities (e.g., using curl, wget, invoke-webrequest) or establishes persistence (e.g., via cron, systemd, registry run keys, schtasks).
Detects potential SSH agent hijacking where process command line activities reference SSH authentication sockets or environment variables, followed closely by a successful SSH connection to a remote host from the same device.
Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
Detects the Shai-Hulud supply chain attack dead-man's switch: a gh-token-monitor persistence component followed by a recursive forced deletion of the user home directory, or the presence of the specific kill-switch string in a command line.
Detects suspicious command-line execution patterns involving Unix shells (bash, zsh, sh) spawned from terminal applications where tools like curl or wget are piped directly into a shell, base64 decoding is performed, osascript executes dialogs, or quarantine attributes are removed.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Summarizes and counts devices based on their system enclosure model and SKU.
Summarizes the total physical memory in gigabytes across reporting devices to assist with hardware inventory and capacity planning.
Page 5 of 174