Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
172 detections
Filters
Last updated
All Time
Detection languages
76
31
20
11
10
Contributors
46
34
16
10
8
Categories
69
66
56
51
23
Platforms
115
45
31
14
8
Products / Services
66
31
30
16
14
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
3
2
1
1
IDS Classtypes
6
2
1
1
IDS Protocols
10
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
Detects successful SSH authentication to a Linux system using public-key authentication by monitoring system logs for the 'Accepted publickey for' message. This rule identifies remote access attempts and serves as a foundation for monitoring lateral movement via SSH.
The aim of this query is detect SSH connections attempts where the external sources are specifying babeld (Network Protocol) or Conker (Network Conf. Manager) as parameters to establish a connection, is detect suspicious activity such as:
Unauthorized SSH connections.
Malicious use of SSH for lateral movement within a network.
Exfiltration attempts via SSH tunneling.
Unauthorized SSH connections.
Malicious use of SSH for lateral movement within a network.
Exfiltration attempts via SSH tunneling.
Detects rapid succession of power-off, suspend, or destroy operations on virtual machines via esxcli or vim-cmd following an SSH login, a behavior pattern often associated with ESXi ransomware activity (e.g., Qilin).
Detects SSH traffic originating from designated edge appliances (e.g., firewalls, NAS devices) directed towards internal network destinations. This pattern is often indicative of network pivoting, lateral movement, or unauthorized remote access from exposed or compromised perimeter assets.
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.
Detects anomalous SSH connections originating from internal network appliances or DMZ-segment devices (e.g., storage, firewalls) to multiple internal network hosts. This behavior is indicative of lateral movement or SSH tunneling as observed in the VerdantBamboo BRICKSTORM campaign, where edge devices are leveraged as pivot points.
This rule detects the installation, service configuration, and key management activities associated with the OpenSSH server on both Windows and Linux environments. It monitors for commands related to installing OpenSSH capabilities or packages, starting the sshd service, modifying SSH registry keys on Windows, creating or modifying configuration files (sshd_config), and updating authorized_keys files. It also flags inbound network connections to non-standard or default SSH ports originating from external IP ranges.
This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.
Detects the use of legitimate SSH clients (ssh.exe, plink.exe) to initiate outbound network connections to internal IP ranges on port 22. This activity is consistent with Obsidian Sandstorm lateral movement tactics, where compromised credentials are used to establish SSH tunnels for internal network pivoting.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
Detects multiple failed SSH authentication attempts against a server from a single source within a short timeframe, which is indicative of a brute force password attack.
Detects execution of the SSH binary with command-line arguments indicative of port forwarding, specifically remote port forwarding (-R) or use of specific ports and IP addresses often associated with unauthorized proxying or command and control tunnels.
This rule monitors Cisco SD-WAN environments for indicators of post-exploitation, including unauthorized SSH lateral movement, abuse of administrative tools (vshell, confd_cli), suspicious tenant list modifications related to CVE-2026-20245, privilege escalation to backdoor accounts, system file tampering (/etc/passwd, /etc/shadow), and anti-forensic activities such as log and history deletion.
Detects rapid succession of power-off, suspend, or destroy operations on virtual machines via esxcli or vim-cmd following an SSH login, a behavior pattern often associated with ESXi ransomware activity (e.g., Qilin).
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Detects indicators of SSH-based lateral movement and credential access, including suspicious SSH command-line flags (e.g., BatchMode, StrictHostKeyChecking), manual enumeration of SSH keys via ssh-add, inspection of agent socket variables, and unauthorized access to critical SSH configuration and identity files by non-standard processes.
Detects unauthorized access and command execution associated with MSP service accounts. The rule triggers on successful SSH authentication using specific service account names (e.g., egnyteservice) followed by the execution of interactive shells under those same service account contexts, which is indicative of potential lateral movement or compromise in downstream environments.
Page 2 of 9