Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects the modification of the 'check_integrity.sh' script to replace 'exit 1' with 'exit 0'. This is a specific defense evasion technique used by the RESURGE malware on Ivanti Connect Secure devices to ensure the compromised system always appears healthy during integrity scans.
This rule detects activity associated with UNC6201 exploiting Dell RecoverPoint VM (CVE-2026-22769), which involves the SLAYSTYLE/BRICKSTORM/GRIMBOLT malware. It identifies attempts to deploy WAR files via Tomcat Manager, suspicious WAR file uploads or modifications in Tomcat directories on Linux appliances, modifications to a persistence script named 'convert_hosts.sh', network communication with a GRIMBOLT C2 endpoint (149.248.11.71), and specific file hashes linked to the threat actor.
Detects the addition of a specific threat actor SSH key to an authorized_keys file for persistence. This key was used in a campaign involving a malicious Go crypto module that delivered the Rekoobe backdoor. The rule specifically looks for command-line activity that modifies the authorized_keys file and contains the hardcoded malicious SSH key, often initiated by shell processes.
Detects two persistence techniques used by EncystPHP: the creation of backdoored root-level accounts and the injection of SSH keys into user accounts. Specifically, it looks for 'useradd' commands creating accounts with UID 0 and specific generic usernames, and modifications to '.ssh/authorized_keys' files by non-root/non-sshd processes.
Detects Linux cron persistence, log tampering, outbound IRC ports, or compiler use from temp paths, matching SSHStalker botnet tradecraft.
This rule detects modifications to AI assistant configuration files by suspicious processes like package managers (npm, yarn) or shell interpreters (bash, powershell). This activity is indicative of a supply chain attack, specifically the SANDWORM_MODE campaign, where an attacker injects a rogue Model Context Protocol (MCP) server entry to hijack AI tools. This enables automated source code and secret theft via prompt injection.
Detects the presence of files matching the SHA256 hashes of known RESURGE malware components, including the main 'libdsupgrade.so' library, the 'liblogblock.so' log tamperer, and the 'dsmain' utility. This rule identifies the creation or modification of these specific files on a device.
This rule detects activities associated with the SSHStalker botnet. It identifies outbound IRC-like network traffic on common IRC ports (6667, 6697, 7000) over TCP. It also looks for persistence mechanisms by monitoring writes to common cron job directories and files on Linux systems. Additionally, the rule detects log tampering attempts by monitoring writes to critical system log files such as /var/run/utmp, /var/log/wtmp, and /var/log/lastlog. Finally, it identifies on-host compilation activities, specifically the execution of compilers (gcc, cc, clang) or build tools (make) within suspicious temporary directories like /tmp, /var/tmp, or /dev/shm, which can indicate malware compilation.
Detects modifications to the RubyGems 'operating_system.rb' file, a technique used by APT37's SNAKEDROPPER malware to achieve persistence by hijacking the Ruby interpreter's execution flow. The rule specifically looks for file creation or modification events on the 'operating_system.rb' file within the RubyGems directory structure, while excluding legitimate 'gem install' operations to reduce false positives.
This rule detects activities associated with UNC6201 exploitation of Dell RecoverPoint VM, specifically looking for three distinct phases: Tomcat Manager WAR file deployment, modification of a persistence script on Linux, and communication with a GRIMBOLT C2 endpoint. The first part identifies WAR file deployments via Tomcat Manager. The second part looks for modifications to a specific persistence script file. The third part identifies network connections to a known GRIMBOLT C2 IP address or URL pattern.
This rule detects various indicators associated with the SSHStalker botnet on Linux systems, including outbound IRC-like network connections, modifications to cron files for persistence, log tampering (specifically utmp/wtmp/lastlog files), and the execution of compilers from suspicious directories like /tmp or /dev/shm. Each section of the rule targets a specific behavior of the botnet.
Detects suspicious modification of AI assistant configuration files potentially related to MCP server injection.
Detects when explorer.exe modifies a .lnk file immediately after a suspicious process (e.g., LOLBAS) is launched by explorer.exe on the same host. This behavior is a forensic artifact of advanced LNK spoofing techniques (Variants 3 and 4 from the referenced research) where Windows "self-repairs" an internally inconsistent shortcut file after its first execution.
Detects modification of the VSCode settings.json file by a process other than VSCode itself. This could indicate an attempt to exploit vulnerabilities where an attacker tricks a user into applying a malicious configuration to achieve remote code execution.
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.
This detection identifies modifications to the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This script is executed at boot time and was observed being modified by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.
Detects modification of the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This technique is used by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.
Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.
The following rule detects attempts to tamper with Linux log records by looking for interpreter processes, or common utility commands interacting with critical log files such as /var/log/wtmp, /var/log/btmp, or /var/run/utmp. It also includes scenarios where 'dd' or 'cp' might be used with /dev/null or /dev/zero to effectively clear or overwrite log content.
Detects malicious activity related to the TCC.db, commonly abused by macOS malware to bypass Transparency, Consent, and Control (TCC) restrictions.
Page 100 of 109