Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects attempts to disable or stop syslog services (syslog, rsyslog, syslog-ng) using common system utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses by preventing logging of their actions.
Detects the use of the GNU Debugger (GDB) to dump memory from a live process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets directly from memory, bypassing file-based security controls.
Detects the addition of a specific threat actor SSH key to an authorized_keys file for persistence. This key was used in a campaign involving a malicious Go crypto module that delivered the Rekoobe backdoor. The rule specifically looks for command-line activity that modifies the authorized_keys file and contains the hardcoded malicious SSH key, often initiated by shell processes.
Detects processes on Linux systems that exhibit fileless execution characteristics while masquerading as common shells or interpreters. This behavior is a key TTP of the ShadowHS post-exploitation framework, which uses argv spoofing and in-memory execution to evade detection.
Detects attempts to disable or stop the 'auditd' service on Linux systems using common service management utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses and avoid logging of their malicious actions.
This rule detects activity related to the DKnife gateway AitM (Adversary-in-the-Middle) threat, as detailed in Talos Intelligence reporting. It identifies specific binary names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin) associated with the threat, either as process names or file names. Additionally, it looks for configuration artifacts (rules.conf, sslmm.cfg, url.cfg) used by the proxy/redirect logic, either as file names or within process command lines. Finally, the rule identifies exfiltration or tagging markers (dkimsi=, 460110672021628, PASSWORD) observed in logs or artifacts, which are indicative of DKnife's reporting mechanisms.
Detects the execution of specific Asterisk CLI commands, often associated with reconnaissance or resource hijacking, by non-interactive or web server accounts. This behavior is a key indicator of the EncystPHP web shell abusing PBX functionality for activities like toll fraud.
This rule detects the presence of environment variables used to control the malicious SANDWORM_MODE payload in CI environments or on local systems. The presence of these variables in a process command line is a strong indicator of an active infection or a workflow being manipulated by the malware's control logic.
This rule detects the execution of processes whose SHA256 hash matches a known hash associated with the MOONRISE RAT malware. It queries DeviceProcessEvents for the last 24 hours and filters for processes with matching SHA256 hashes.
Detects the presence or execution of known TeamPCP malware and infrastructure tools (proxy.sh, kube.py, pcpcat.py, and tunneling tools like FRPS/gost) based on their MD5 file hashes. The group uses these standardized payloads to automate their operations.
This detection identifies the use of the 'kill' command with a specific, non-standard real-time signal (-59). Rootkits like 'Singularity' use these 'magic' signals as an out-of-band communication channel to trigger actions within a malicious kernel module, such as toggling stealth features or granting root privileges.
Detects the execution of the deprecated Google 'software_reporter_tool.exe' from suspicious user-writable directories. This technique is used by the CRESCENTHARVEST malware campaign to perform DLL sideloading using a signed, but deprecated, binary to evade defenses.
Detects Notepad++ installer and portable files where the file hash does not match a list of known legitimate hashes. This could indicate a malicious file masquerading as Notepad++.
Detects PowerShell command lines that exceed a certain length of characters or more, which may indicate obfuscated or automated malicious activity. It also specifically looks for common PowerShell download and execution patterns within the command line.
This rule detects activity related to the Chrysalis Backdoor, which is associated with the Lotus Blossom threat group. It identifies malicious activity through three main components: 1. File and process events matching a list of known malicious SHA256 hashes. 2. Network connections to known malicious IP addresses or domains. 3. Suspicious execution of 'svchost.exe' from non-standard Windows directories with specific command-line arguments, indicating potential masquerading or malicious execution.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to attacker-controlled cloud buckets.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detects the use of non-standard kill signals (-900, -901) used to manage the ShadowGuard eBPF rootkit's process allow-list. This activity is associated with the TGR-STA-1030 threat actor.
Detects known malicious file hashes associated with the Clawdbot VS Code extension malware. This includes the weaponized ScreenConnect installer (Code.exe) and the Rust-based loader (DWrite.dll).
Detects process, network, and file events associated with the fake 'ClawdBot Agent' VS Code extension. This malware drops weaponized ScreenConnect (Code.exe) and a Rust-based DWrite.dll loader. The rule covers Lightshot staging paths, relay C2 (bulletmailer.net:8041), extension C2 domains (getintwopc.site, clawdbot.getintwopc, darkgptprivate.com), and known payload hashes.
This rule detects the presence or execution of known malicious file hashes associated with the ClawdBot campaign. It monitors file creation/modification events, process creation events, and module/image load events across devices for specific SHA256 hashes. The identified hashes correspond to components like 'Code.exe', 'zoomupdate.msi', 'DWrite.dll', 'extension.js', and 'run.bat', which are known to be part of the ClawdBot malware.
Page 73 of 84