Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This detection identifies the use of the chattr command on Linux endpoints to add or remove the immutable (+i/-i) attribute on files. Threat actors abuse this technique to protect malicious files (such as persistence mechanisms or web shells) from modification or deletion, or to remove immutability from system files prior to tampering. Investigate the parent process, executing user, and target file path to determine whether the activity aligns with legitimate administrative work or indicates anti-forensics or persistence behavior.
Detects modifications to /home/vmanage-admin/.ssh/authorized_keys on Cisco SD-WAN controllers (vSmart, vManage, vBond) by any process. This file is a post-exploitation persistence target documented by Resecurity and Rapid7 for CVE-2026-20182. Legitimate modifications to this file are extremely rare in production SD-WAN deployments, as the vmanage-admin account is an internal service account and its authorized_keys file is provisioned during initial deployment and rarely touched afterward. Any write event is worth immediate investigation.
Detects file creation, modification, or renaming events in the suspicious '%AppData%\WinDataScope' directory. This directory is hardcoded in the FrostyNeighbor dropper for staging PicassoLoader, indicating potential malware activity.
Linux Timestomping via Reference FIle
Cortex XDR
Detects the use of the 'touch' command on Linux with '-m' and '-r' (reference file) or '--reference' arguments. This combination can be used for timestomping, a technique to modify file timestamps to evade detection or forensic analysis by making malicious files appear to have legitimate creation/modification times.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects the creation of files indicative of the compromised Checkmarx AST plugin version 2026.5.09 being deployed. This rule identifies specific malicious filenames or known compromised SHA256 hashes associated with the TeamPCP backdoor.
Linux Pam Modification
YARA-L
Detects modifications to Linux PAM configuration files or module directories, potentially indicating PAM backdoor installation such as PamDOORa. Assigns higher risk for unusual processes or multiple file modifications.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects potential user namespace manipulation, a common precursor to kernel namespace exploits like Dirty Frag, by monitoring file modifications to uid_map and gid_map.
Detects write operations or modifications to 'uid_map', 'gid_map', or 'setgroups' files within the /proc directory.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
Detects a process modifying multiple privileged namespace mapping files (uid_map, gid_map, setgroups) under /proc. This behavior is used by the Dirty Frag xfrm-ESP exploit variant to gain CAP_NET_ADMIN privileges prior to exploiting the Linux kernel page-cache write vulnerability.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
PhantomRaven Temporary Payload Creation
Cortex XDR
Detects Node.js dropping the PhantomRaven dynamic Stage-3 payload into the /tmp directory. The attack utilizes a file-based temporary dropper that operates outside of standard NPM package paths, bypassing static code analysis.
This rule detects the creation, modification, or execution of files matching a predefined list of known malicious SHA256 hashes. It correlates file and process events to identify the presence and activity of these specific malicious artifacts on monitored systems.
Page 96 of 109