Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
460 detections
Filters
Last updated
All Time
Detection languages
143
106
71
62
54
Contributors
166
120
68
47
15
Categories
215
214
77
73
63
Platforms
341
222
216
18
14
Products / Services
10,670
9,758
6,693
4,421
3,749
460
MITRE Techniques
145
117
82
74
64
CVEs
6
5
5
5
5
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
Detects the execution of 'bun' during a Node.js package installation process (npm or node). This behavior can be indicative of a supply chain attack where malicious actors attempt to leverage alternative runtimes during the 'preinstall' phase or package installation to execute arbitrary code or bypass security controls typically associated with standard Node.js installations.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects instances where AI coding agents (such as Claude Code, Copilot, etc.) execute git commands (checkout, fetch, clone) using a branch name or reference formatted as a 40-character hex string. This behavior is indicative of a 'Plugin4Shell' style bypass, where an attacker crafts a branch name that mimics a commit SHA to cause ambiguous refname errors or hijack repository operations.
Detects the execution of 'bun' during a Node.js package installation process (npm or node). This behavior can be indicative of a supply chain attack where malicious actors attempt to leverage alternative runtimes during the 'preinstall' phase or package installation to execute arbitrary code or bypass security controls typically associated with standard Node.js installations.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections.
Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.
Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.
Detects the execution of OrionQuests-Setup.exe, a .NET-based executable identified as a malicious installer used by the Kimsuky (APT-C-55/BabyShark) threat group. The rule flags PE files that match the specific filename and contain both .NET framework indicators and references to LNK files, suggesting the dropper mechanism for initial stage infection.
This rule detects files that feature a valid RTF file header (literal '{' followed by 'rtf1') at the start of the file, but lack standard RTF control words such as \ansi or \fonttbl. The presence of executable content, PowerShell commands, or script markers within these files indicates a file-type masquerading technique used to bypass security controls by disguising malicious payloads as RTF documents.
Detects the execution of 'bun' during a Node.js package installation process (npm or node). This behavior can be indicative of a supply chain attack where malicious actors attempt to leverage alternative runtimes during the 'preinstall' phase or package installation to execute arbitrary code or bypass security controls typically associated with standard Node.js installations.
Detects the execution of 'bun' during a Node.js package installation process (npm or node). This behavior can be indicative of a supply chain attack where malicious actors attempt to leverage alternative runtimes during the 'preinstall' phase or package installation to execute arbitrary code or bypass security controls typically associated with standard Node.js installations.
Detects known KATARU IoT malware binaries via embedded strings and known SHA-256 hashes
Detects DragonForce ransomware note (readme.txt) referencing known DragonForce Tor negotiation/blog onion addresses
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic.
The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host.
It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly.
Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution.
The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host.
It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly.
Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
Detects a single process accessing multiple distinct sensitive files related to cryptocurrency wallets, SSH keys, or seed phrases within a short duration. This pattern of bulk file access is highly indicative of automated credential harvesting modules like those found in the CRPx0 malware family.
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Page 6 of 22