Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects the presence of the compromised anthropic.claude-code VS Code extension version 2.1.313 or its associated bad hash on disk, reverse SSH tunneling spawned by code editors or extension hosts, and network connections to known malicious C2 IP address 134.209.82.225.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Identifies devices running PHP versions affected by CVE-2026-109618 or CVE-2026-109619. The detection returns affected hosts, operating system platform, installed PHP version, and associated IPv4 addresses to support vulnerability assessment and remediation.
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Detects indicators of compromise associated with a trojanized Claude Code VS Code extension distributed through Cursor's marketplace. The rule identifies file modifications to authorized_keys, process executions establishing reverse SSH tunnels, specific hardcoded C2 IP addresses, and references to the attacker's SSH key 'svc-telemetry'.
Identifies devices that have communicated with domains present in the OpenPhish public phishing feed by comparing domains observed in DeviceNetworkEvents.RemoteUrl against domains extracted from the current OpenPhish feed.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects persistence mechanisms installed by the trojanized Claude Code extension on Cursor or Node-based applications. On macOS, it detects the creation of LaunchAgent property list files. On Windows, it detects scheduled tasks created via schtasks.exe or event logs, and modifications to the Startup folder.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Detects Node.js builds, Express, and body-parser libraries vulnerable to CVE-2026-111497 (Node2Shell) via Microsoft Defender vulnerability inventory, process telemetry, and software inventory.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Detects processes reconnecting to a public IPv4 or IPv6 address after at least 7 days of inactivity on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects modifications to Certificate Authority (CA) trust stores, configuration files, or blocklists on Linux and macOS endpoints, followed by trust store update commands within a 30-minute window.
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Detects process command lines containing Magento database audit strings (cms_block, cms_page) alongside specific loader domains, or network events communicating with these known loader domains.
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Page 1 of 174