Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
164 detections
Filters
Last updated
All Time
Detection languages
77
32
13
10
9
Contributors
55
38
13
9
8
Categories
104
95
87
64
61
Platforms
155
16
9
5
4
Products / Services
99
49
27
14
11
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
3
1
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the Redis server process writing or modifying files within cron configuration directories. This is a common persistence technique used by attackers to gain recurring execution after exploiting vulnerable or misconfigured Redis instances.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects a Redis process connecting to a suspected rogue replication master (using non-standard ports or known malicious IPs) followed by a file modification to a system cron directory. This sequence is indicative of a Redis Rogue Replication exploit where a crafted RDB file is used to achieve persistence by writing a malicious entry to a cron job.
Detects unauthorized modification of system cron files by the redis-server process, indicative of rogue redis replication exploitation, followed by the execution of a cron job associated with the XMRig cryptocurrency miner.
Detects the creation of files within the /etc/cron.d/ directory initiated by the redis-server process, specifically looking for malicious payloads containing bash -c and /dev/tcp/ command wrappers indicative of a reverse shell or beaconing persistence mechanism often used by Redis-targeting botnets.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects the creation or modification of scheduled tasks (cron jobs) located within web application log directories (e.g., JBoss, Tomcat, Wildfly) that exhibit behavior consistent with malicious file reinjection. This rule correlates suspicious cron activity with recurring modifications to sensitive web files (e.g., JS bundles, checkout pages), indicating persistent skimmer activity that survives redeployment.
Detects the deployment and activity of SilkParasite-associated Linux threats, including XMRig cryptocurrency miner shell scripts and standalone Meterpreter agents. The rule also captures the execution of a custom Python fleet-scanning tool used to interact with exposed Redis instances for unauthorized command execution and infrastructure management.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
Detects modifications or creations of files within the /var/spool/cron directory specifically involving the postgres user, as well as process execution of the 'crontab' utility by or for the postgres user. This activity may indicate an adversary attempting to establish persistence or execute code with postgres privileges.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Page 2 of 8