Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,482 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,168
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,482
11,866
5,884
5,164
4,867
Platforms
18,085
3,046
1,506
124
104
Products / Services
5,725
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects suspicious activity involving the uptime utility on Linux systems. This includes execution from non-standard paths, invocation with unexpected command-line arguments, execution with unusual parent processes, or evidence of the uptime binary being overwritten or written to a non-standard location. Such behavior is often indicative of masquerading or attempts to hide malicious activities.
Detects instances where the Windows Subsystem for Linux (WSL) process (wsl.exe) is used to execute native Windows command-line interpreters or utilities. This behavior is often associated with attackers using WSL as a living-off-the-land technique to evade security monitoring, run obfuscated payloads, or bypass execution restrictions by crossing the Linux/Windows boundary.
Detects the deployment and execution of GS-Netcat (gsocket), a tool often used for creating persistent reverse shells or backdoors. The rule identifies processes associated with gsocket, instances where the 'uptime' command is masqueraded with suspicious command-line arguments, and unauthorized creation or modification of systemd service files designed for persistence.
Detects potential credential harvesting activities targeting the SSH and PAM authentication stacks. The rule identifies suspicious file operations (creation/modification/read) by authentication-related processes (sshd, login, su, sudo) involving sensitive files like /etc/shadow or non-standard file paths in temporary directories, as well as the spawning of interpreters that write to these suspicious locations.
This rule detects low-frequency, external network connections originating from Linux processes that are either explicitly known to be associated with malicious tools (e.g., gs-netcat, gsocket, atlasd) or are masquerading as legitimate system utilities (e.g., uptime, smbd) in a manner consistent with the Velvet Ant Operation Highland activity. The detection aggregates connections by process metadata and flags low-frequency outbound traffic, which is indicative of C2 beaconing.
This rule detects potentially malicious or masqueraded Samba (smbd) activity on Linux systems. It monitors for three conditions: smbd processes launched from non-standard binary paths, smbd process network activity from non-standard binary paths, and smbd processes spawned by unauthorized or unexpected parent processes. These patterns are often associated with unauthorized SMB service deployment, malware persistence, or masquerading techniques.
Identifies CastleLoader's core execution behavior: python.exe or pythonw.exe executing compiled bytecode (.pyc) from heavily obfuscated or anomalous directories inside C:\ProgramData\ with an active network connection.
Detects execution activity associated with the Kimsuky NUKESPED loader, specifically identified by the script interpreter spawning processes or making network requests related to specific decoy URLs (NHIS health portal) or opening decoy PDF files from the user's Downloads directory.
Detects the execution of fltMC.exe originating from a temporary folder, which is indicative of potential malicious activity. The rule monitors for suspicious child processes spawned by this binary, outbound network connections, and file system operations (creation, modification, renaming) associated with this execution context.
Detects execution of common discovery binaries (tasklist, netstat, ipconfig, net, whoami, query) when spawned by the filter manager utility (fltMC.exe) or its children, a behavior observed in the Red Lamassu JFMBackdoor post-compromise activity.
Detects the suspicious execution of fltMC.exe or the loading of FLTLIB.dll from temporary directories, which is a known behavior of JFMBackdoor malware. It also detects known SHA256 hashes associated with this threat.
This rule detects suspicious process execution chains associated with known Kimsuky campaign activity and NUKESPED malware. It identifies the execution of the NUKESPED secondary payload 'zlrenu8.exe' and a specific sandbox-evading JSE loader chain where WScript or CScript spawns hidden PowerShell instances using 'certutil' to decode files stored in the ProgramData directory.
Detects execution and staging activity associated with the NUKESPED (ThreatNeedle) malware family. The rule looks for the execution of known secondary executable names, payload files staged in the ProgramData directory, and a specific process lineage where PowerShell is spawned from WScript or CScript to launch processes from the ProgramData directory.
Detects the execution of batch scripts that invoke file transfer utilities (certutil, bitsadmin, or powershell) to download components into temporary directories, a behavior associated with the Red Lamassu campaign.
Detects signs of JDY botnet activity on Linux systems, specifically identifying shell-based payload downloads using curl or wget, or the execution of binaries directly from temporary directories, a pattern common in IoT firmware compromises.
Detects the execution of the NUKESPED backdoor (specifically the file named zlrenu8.exe), which is associated with Kimsuky's espionage operations, including screen capture activities.
Detects the Showboat Linux malware which hides its presence by masquerading as a kernel worker process. This is identified by a process with 'kworker' in its name or command line that originated from a resolvable on-disk binary path, which is characteristic of user-space processes rather than legitimate kernel threads.
Detects the Kimsuky NUKESPED JSE loader anti-analysis pattern. The rule monitors for wscript.exe executing a JSE file, followed by a delayed PowerShell execution containing hidden window flags, decoding or non-interactive flags, and references to ProgramData, which is consistent with sandbox evasion and NUKESPED payload staging.
This rule detects the execution of the NUKESPED backdoor component 'zlrenu8.exe' and its subsequent outbound HTTP/HTTPS network connections to specific IP addresses associated with Fastly CDN. This behavior is highly characteristic of sensitive data exfiltration activities performed by the Kimsuky threat group.
Detects instances where Windows NearShare or QuickShare utilities spawn child processes that are not part of their standard operational or helper suite (e.g., conhost.exe, WerFault.exe, svchost.exe). This pattern is often indicative of process injection, living-off-the-land techniques, or unauthorized activity masquerading as legitimate Windows sharing services.
Detects web browsers and browser-related applications (e.g., Chrome, Edge, ChatGPT, Electron apps) spawning suspicious child processes that are commonly used for command-line execution or script interpretation. This behavior is often indicative of malicious extensions, browser exploits, or attempts to leverage browser processes for initial execution or lateral movement.
Page 451 of 976