Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
164 detections
Filters
Last updated
All Time
Detection languages
77
32
13
10
9
Contributors
55
38
13
9
8
Categories
104
95
87
64
61
Platforms
155
16
9
5
4
Products / Services
99
49
27
14
11
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
3
1
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects malicious behaviors involving the Chisel tunneling tool, including reverse SOCKS proxy connections with TLS verification skipped, cron-based persistence referencing watchdog scripts in hidden /var/tmp directories, and associated tool staging activities.
Detects a sequence where a FortiSIEM-related process writes or modifies a shell script in a cron or phoenix directory, followed closely within 2 minutes by a child process spawned by cron executing that same written script file.
Detects a process launch whose command line both references a cron persistence path (crontab, /etc/cron.d/, /etc/crontab, /etc/cron.{hourly,daily,weekly,monthly}/, /var/spool/cron/crontabs/) and contains a download-and-execute or reverse-shell marker (curl/wget piped to a shell, /dev/tcp/ redirection, base64-decoded payload, nc -e) or installs the crontab from a file staged under /tmp/. Attackers commonly install a scheduled cron entry so a malicious command re-executes on a fixed interval, surviving reboots and process kills (T1053.003).
Detects creation or modification of cron entries on the BeyondTrust
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Detects crontab modifications or suspicious command execution spawned by the cron daemon on macOS devices, indicating potential persistence or scheduled task abuse.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
This rule detects potential post-exploitation activity on a NetScaler appliance where a crontab modification occurs within a short window (1 hour) following suspicious syslog entries indicative of oversized-parameter buffer overflow exploitation attempts (CVE-2026-88771/CVE-2026-88772).
Detects instances where a process writes to known persistence locations, including Windows Registry Run keys, the Windows Startup folder, Linux shell profile configuration files (.bashrc/.bash_profile), and system-level task directories (cron and systemd units). This activity is often indicative of malicious persistence mechanisms, such as those used by compromised AI agents or backdoors to survive system reboots.
Detects the creation of scheduled tasks (Windows), cron jobs (Linux), or systemd timers where the initiating process is a common scripting or runtime interpreter (e.g., Python, Node.js, PowerShell, Java). This activity is often indicative of persistence mechanisms being established by a compromised agent or script-based process.
Detects the creation of scheduled tasks (Windows), cron jobs (Linux), or systemd timers where the initiating process is a common scripting or runtime interpreter (e.g., Python, Node.js, PowerShell, Java). This activity is often indicative of persistence mechanisms being established by a compromised agent or script-based process.
Detects the creation of scheduled tasks, recurring jobs, or webhook subscriptions by a user identity flagged as an AI_AGENT. This activity is monitored for persistence, especially when the event lacks a descriptive context or targets external networks, suggesting potential unauthorized agent behavioral drift or malicious persistence.
Detects persistence mechanisms associated with the CARBONATO botnet. The rule identifies two primary behaviors: the execution of a hidden watchdog binary '/usr/local/bin/.docker-network-monitor' by the cron daemon, and the use of 'chattr +i' to make this watchdog binary immutable, preventing deletion or modification.
Detects the creation of scheduled tasks, recurring jobs, or webhook subscriptions by a user identity flagged as an AI_AGENT. This activity is monitored for persistence, especially when the event lacks a descriptive context or targets external networks, suggesting potential unauthorized agent behavioral drift or malicious persistence.
Detects evidence of persistence mechanisms associated with the CARBONATO botnet on Linux systems. This includes the application of chattr +i to the malicious watchdog binary, the execution of the auto-persist-host.sh script, the enabling of the docker-network-resolver systemd timer, or modifications to crontab for watchdog execution.
Detects persistence mechanisms used by the CARBONATO botnet on Linux-based Docker hosts. The rule monitors for the application of immutable file attributes using 'chattr +i' on identified watchdog binaries (specifically '.docker-network-monitor'), the creation of malicious cron jobs, the enabling of suspicious systemd timers ('docker-network-resolver'), and the execution of specific persistence-related shell scripts.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects attempts to modify the Redis configuration (dir or dbfilename) followed by a SAVE command, which can be leveraged to write arbitrary data to critical system files such as crontabs for persistence.
This rule detects multiple suspicious file write operations on a Linux host, specifically targeting directories often used for persistence such as /etc/apt/apt.conf.d, /etc/profile.d, and /etc/cron.d. The rule flags hosts where at least two of these specific persistence techniques are utilized within a 24-hour window, which is indicative of an automated, redundant persistence strategy often employed by cryptocurrency miners like XMRig.
Detects the creation or modification of a file within the /etc/cron.d/ directory, followed shortly by a Bash process invocation using /dev/tcp redirection. This pattern is commonly used by attackers to achieve persistence via cron and establish reverse shells, bypassing potential limitations of default system shells that do not support /dev/tcp syntax.
Page 1 of 8