Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
460 detections
Filters
Last updated
All Time
Detection languages
143
106
71
62
54
Contributors
166
120
68
47
15
Categories
215
214
77
73
63
Platforms
341
222
216
18
14
Products / Services
10,670
9,758
6,693
4,421
3,749
460
MITRE Techniques
145
117
82
74
64
CVEs
6
5
5
5
5
Detects the execution of the GS-Netcat network utility with flags characteristic of reverse shells (e.g., -e, -i, -S, -D) in conjunction with the creation of a systemd service unit file on the same host, which is a technique used by the Velvet Ant threat actor for persistence.
Detects the presence of a malicious Electron-based backdoor disguised as the Franz messaging application, commonly associated with the 'ClickFix' campaign. The rule identifies indicators such as a specific C2 endpoint, automated persistence via Electron login item settings, arbitrary JavaScript execution through a 'task.e' sink, and the creation of local persistence files like 'readme.txt' and 'setup.txt'.
This rule detects the installation, service configuration, and key management activities associated with the OpenSSH server on both Windows and Linux environments. It monitors for commands related to installing OpenSSH capabilities or packages, starting the sshd service, modifying SSH registry keys on Windows, creating or modifying configuration files (sshd_config), and updating authorized_keys files. It also flags inbound network connections to non-standard or default SSH ports originating from external IP ranges.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects network and process execution activity involving Google or Microsoft OAuth2 token endpoints from non-browser and non-trusted processes. This behavior is indicative of potential token theft or session hijacking attempts, where malicious tools (e.g., curl, python) are used to access authentication endpoints to bypass standard user interaction.
Detects potential container escape attempts via 'docker cp' path traversal attacks or suspicious shell execution spawned from the Docker daemon. The rule monitors for directory traversal sequences in 'docker cp' commands, the use of PoC tooling strings, file modifications outside expected container paths, and shell process spawning originating from Docker-related parent processes.
Detects execution of unusual preinstall, setup, or GitHub scripts initiated by Node Package Manager (npm) or node processes. This behavior is indicative of a supply chain attack or malicious dependency execution during the installation process of a package.
This rule monitors for processes attempting to enumerate sensitive environment variables related to cloud services (AWS) and AI platforms (Anthropic), or access specific configuration and credential files (e.g., .aws/credentials, .config/anthropic). It specifically correlates these behaviors with potentially suspicious parent processes like bash, node, or python interpreters, which may indicate an AI agent or a reverse shell performing reconnaissance or credential exfiltration.
Detects suspicious child processes spawned by AI coding agents that are potentially indicative of an indirect prompt injection attack. The rule specifically looks for the execution of 'axiom init' or 'pip install' commands, which are often used by attackers to execute malicious code within an environment when tricked by instructions embedded in repository files.
Detects indicators of SSH-based lateral movement and credential access, including suspicious SSH command-line flags (e.g., BatchMode, StrictHostKeyChecking), manual enumeration of SSH keys via ssh-add, inspection of agent socket variables, and unauthorized access to critical SSH configuration and identity files by non-standard processes.
Detects PHP processes reading both /proc/self/maps and /proc/self/mem within a short time window. This activity is indicative of an Address Space Layout Randomization (ASLR) bypass technique, specifically associated with exploits attempting to compute memory offsets for sensitive functions (e.g., zend_execute_internal, zif_system) to facilitate Remote Code Execution (RCE).
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
Detects anomalous process spawning where VS Code or Amazon Q language server processes (e.g., node, amazonq-lsp) execute shell utilities (e.g., bash, curl) with arguments related to .amazonq/mcp.json or specific credential/exfiltration commands. This behavior is associated with the exploitation of the MCP server auto-execution vulnerability (CVE-2026-12957).
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Detects suspicious git commit activity associated with the IronWorm campaign. The rule monitors for git operations involving backdated commits or force-pushes, particularly those using a specific noreply email address or common maintenance commit messages, which are indicative of supply-chain compromise and timestomping techniques within npm repositories.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects Linux processes masquerading as common daemons (smbd, httpd, sshd, crond) that are executing from non-standard file paths and establishing network connections on non-canonical ports to private (RFC1918) IP addresses. This behavior is indicative of a SOCKS5 proxy or C2 infrastructure masquerading as system services to blend in with legitimate traffic, as observed in Velvet Ant operations.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects evidence of the MYRA Linux RAT attempting to establish persistence via the LD_PRELOAD environment variable mechanism. The rule monitors for the creation or modification of specific malicious library files (libcache.so, .sh.local) and the execution of processes utilizing LD_PRELOAD to hijack dynamic linker operations.
Detects host-level configuration changes indicative of preparing a system for the CVE-2026-46331 pedit COW exploit. This includes enabling unprivileged user namespaces via sysctl and disabling security mitigations or removing the act_pedit kernel module.
Page 9 of 22