Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
6
3
2
1
Contributors
3
3
2
2
1
Categories
10
6
4
3
2
Platforms
8
6
1
Products / Services
4
4
4
3
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
1
This rule detects various activities related to the installation, configuration, and execution of OpenSSH on Windows systems. It looks for processes adding the OpenSSH server capability, creating the sshd service, generating SSH keys, and the execution of the sshd.exe process. It also includes a specific hash for a known malicious SSH artifact and firewall rule additions containing 'SSH'.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects vLLM performing unauthorized system reconnaissance by executing common system information discovery commands such as 'whoami', 'id', 'uname', 'hostname', 'ifconfig', and 'ip'. This activity is indicative of an attacker attempting to gather information about the compromised system.
Detects PHP or web server processes launching common system, account, network, and domain reconnaissance utilities. This activity is often indicative of post-compromise internal reconnaissance, as web-facing application processes should not normally start these utilities. The rule specifically looks for processes like php.exe, w3wp.exe, httpd.exe, apache2, and nginx spawning reconnaissance tools such as whoami, hostname, systeminfo, ipconfig, ifconfig, net, nltest, dsquery, quser, and query.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated query:
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. Such actions typically involve commands or tools used to identify network interfaces, routing tables, and active connections. Detecting these activities is crucial, as they often precede more targeted attacks like lateral movement or data exfiltration. By identifying unusual or unauthorized network discovery efforts, this analytic helps security teams to swiftly detect and respond to potential reconnaissance operations, mitigating the risk of further compromise.
The analytic identifies potential enumeration of local network configuration on Linux systems. It detects this activity by monitoring processes such as "arp," "ifconfig," "ip," "netstat," "firewall-cmd," "ufw," "iptables," "ss," and "route" within a 30-minute window. This behavior is significant as it often indicates reconnaissance efforts by adversaries to gather network information for subsequent attacks. If confirmed malicious, this activity could enable attackers to map the network, identify vulnerabilities, and plan further exploitation or lateral movement within the environment.
Detects the execution of common macOS command-line utilities used for enumerating local network configuration and firewall settings. This includes tools like 'arp', 'ifconfig', 'netstat', 'networksetup', and 'socketfilterfw', as well as 'defaults' when querying specific firewall preferences.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
This rule detects attempts to enumerate local network configuration on Linux systems. It specifically looks for the execution of common network utilities such as 'firewall-cmd', 'ufw', 'iptables', 'netstat', 'ss', 'ip', 'ifconfig', 'systemd-resolve', and 'route'. Additionally, it triggers if '/etc/resolv.conf' is present in the command line, indicating an attempt to inspect DNS resolver configuration.