Skip to content
.ca
sign in

Detection rules

YARA, Suricata, Sigma and host-hunt rules pulled from the reports. Click a rule to see the full text and every post that uses it, or pull the set as JSON via the feed. We don't serve loadable rule files by design — copy and review before you deploy.

TypeRulePostsLast seen
suricataN4D Worm - Agent download from cdnorigin.net12026-07-18
suricataN4D Worm - Agent download from Mesh Control C212026-07-18
suricataMCP JSON-RPC initialize from external source12026-07-18
suricataIVANTI SENTRY CVE-2026-10520 MICS handleMessage POST (pre-auth RCE attempt)12026-06-21
suricataATTACK Docker create body binds host root filesystem12026-06-16
suricataATTACK Docker create body uses chroot for host-namespace escape12026-06-16
suricataATTACK dockerpwn persistence script delivery in HTTP request body12026-06-16
suricataATTACK Inbound Docker Engine API container create from external source12026-06-16
suricataATTACK Inbound Docker Engine API exec/start from external source12026-06-16
suricataATTACK 'Polly for Sonya' Cyrillic-language Docker pwn tooling marker12026-06-16
suricataC2 VoidLink agent binary download (fleet-agent-linux)12026-06-16
suricataC2 VoidLink agent enrolment (POST /api/agents/enroll)12026-06-16
suricataC2 VoidLink agent WebSocket channel (GET /ws/agent)12026-06-16
suricataC2 VoidLink bootstrap fetch, token-shape key (EXPERIMENTAL)12026-06-16
suricataC2 VoidLink bootstrap install script fetch12026-06-16
suricataPOLICY Inbound Docker Engine API container create from internal source12026-06-16
suricataPOLICY Inbound Docker Engine API exec/start from internal source12026-06-16