Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
172 detections
Filters
Last updated
All Time
Detection languages
76
31
20
11
10
Contributors
46
34
16
10
8
Categories
69
66
56
51
23
Platforms
115
45
31
14
8
Products / Services
66
31
30
16
14
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
3
2
1
1
IDS Classtypes
6
2
1
1
IDS Protocols
10
Detects network device configuration commands via SSH
Detects repeated SSH authentication failures indicating brute force
Detects ESXi hypervisor CLI access via direct SSH connection
Detects a single process initiating SSH connections to a large number of distinct private IP addresses within a ten-minute window. This behavior can indicate automated lateral movement, credential spraying, or other malicious network reconnaissance activities.
Detects the use of sshpass combined with disabled strict host key checking. This pattern matches the propagation scripts used by UNC6240 for rapid lateral movement across internal nodes following Oracle PeopleSoft exploitation.
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts' for target identification. The rule looks for multiple SSH connections within a 10-minute window from a single host and user, specifically targeting common PeopleSoft-related usernames.
Detects automated credential spraying and lateral movement attempts using the sshpass utility targeting common Oracle/PeopleSoft usernames. This specific combination of parameters and targeted accounts matches the bash script deployment mechanism utilized by the ShinyHunters extortion gang.
Detects SSH connections between internal hosts indicating lateral movement
This rule detects potential internal SSH lateral movement attempts. It triggers an alert when there are 5 or more TCP SYN packets (indicating connection attempts) to port 22 (SSH) within a 60-second window, originating from a host within the home network and targeting another host within the home network. This threshold-based detection aims to identify rapid, repeated SSH connection attempts that could signify an attacker trying to move between internal systems.
Detects SSH agent forwarding being abused for lateral movement
This rule detects SSH connections initiated by 'ssh.exe' that involve remote port forwarding ('-R' flag) or potential SSH tunneling (command line containing both '@' and ':'). This behavior can be indicative of adversaries establishing covert communication channels or maintaining persistence.
This rule detects potential SSH agent forwarding abuse, which can be used for lateral movement within a network. It specifically looks for a byte sequence ('|00 00 00 1c 0b|') within TCP traffic on port 22 (SSH) flowing to the server, indicating an established connection. This byte sequence is characteristic of SSH agent forwarding requests.
Detects the creation or execution of the SSH propagation payload script (.sshu-setup.js), used by the Hades stealer to propagate via SSH from compromised workstations. This rule identifies file creation/modification/renaming events for the specific script name, or process creation events where the command line references the script.
Detects process executions containing SSH tunneling or port forwarding parameters correlated with outbound network connections to external public IPs. This may indicate protocol tunneling for evasion or data exfiltration.
Detects successful network connections over FTP (port 21) or SSH (port 22) initiated by common file transfer applications such as WinSCP, FileZilla, psftp, or scp. This activity could indicate data exfiltration, unauthorized access, or command and control.
Detects Bitbucket global SSH access configuration changes.
Detects processes referencing confirmed TeamPCP C2 infrastructure or known malicious artifacts from the Trivy supply chain compromise. This includes specific C2 domains/IPs, temporary runner files, and a specific tarball name. It also looks for `entrypoint.sh` executing `grep` for environment variables or SSH-related strings, which could indicate credential access attempts.
Detects modifications to AWS EC2 security groups that allow SSH (port 22) or RDP (port 3389) access from any IP address (0.0.0.0/0) to instances. This configuration significantly increases the attack surface and can be an indicator of unauthorized access attempts, misconfigurations, or malicious activity.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
This rule detects suspicious command-line activity indicative of SSH tunneling, external IP checks, and reconnaissance commands. It looks for specific IP addresses associated with known C2 or SSH tunnel infrastructure, SSH command-line options like 'StrictHostKeyChecking=no' and reverse tunnel flags ('-R', '-N'), the use of 'ifconfig.me' for external IP discovery, and various 'whoami' and 'groups' commands for system reconnaissance. It also flags activity related to 'FMAPP.exe' or 'FMAPP.dll'.
Detects possible MuddyWater related activity in Microsoft Defender XDR Advanced Hunting by correlating suspicious process, network, file, and logon telemetry into a unified timeline. The hunt focuses on behaviours reported in the Huntress MuddyWater attack chain, including Remote Desktop logons, reconnaissance commands, OpenSSH reverse tunnelling, suspicious network connections, and possible DLL side loading involving FMAPP.exe and FMAPP.dll.
Page 6 of 9