Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
3
Categories
2
2
1
Platforms
3
Products / Services
10,421
9,526
6,520
4,406
3,688
MITRE Techniques
2
2
1
Detects pgrep searching for ngrok, cloudflared, or wireguard-go process names from within a Claude Code shell-snapshot session, indicating discovery of tunnel/VPN tooling as part of an agent-driven attack chain.
Detects pgrep searching for ngrok, cloudflared, or wireguard-go process names from within a Claude Code shell-snapshot session, indicating discovery of tunnel/VPN tooling as part of an agent-driven attack chain.
Detects presence of pritunl-client or wireguard-go binary/name strings, tunnel/VPN-class tooling observed landing on host prior to agent-parented tunnel activity