Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,643 detections
Filters
Last updated
All Time
Detection languages
1,767
374
349
273
255
Contributors
908
676
593
359
164
Categories
1,499
1,168
780
528
520
Platforms
39,932
7,263
6,535
3,865
3,643
Products / Services
807
512
432
340
299
MITRE Techniques
1,179
579
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Identifies devices running PHP versions affected by CVE-2026-109618 or CVE-2026-109619. The detection returns affected hosts, operating system platform, installed PHP version, and associated IPv4 addresses to support vulnerability assessment and remediation.
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Identifies devices that have communicated with domains present in the OpenPhish public phishing feed by comparing domains observed in DeviceNetworkEvents.RemoteUrl against domains extracted from the current OpenPhish feed.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Detects Node.js builds, Express, and body-parser libraries vulnerable to CVE-2026-111497 (Node2Shell) via Microsoft Defender vulnerability inventory, process telemetry, and software inventory.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects processes reconnecting to a public IPv4 or IPv6 address after at least 7 days of inactivity on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects modifications to Certificate Authority (CA) trust stores, configuration files, or blocklists on Linux and macOS endpoints, followed by trust store update commands within a 30-minute window.
Detects process command lines containing Magento database audit strings (cms_block, cms_page) alongside specific loader domains, or network events communicating with these known loader domains.
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Page 1 of 174