Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
164 detections
Filters
Last updated
All Time
Detection languages
77
32
13
10
9
Contributors
55
38
13
9
8
Categories
104
95
87
64
61
Platforms
155
16
9
5
4
Products / Services
99
49
27
14
11
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
3
1
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects indicators of persistence on Linux systems, specifically targeting unauthorized cron job creation/deletion in /etc/cron.d/, execution of suspicious shell scripts (ssync.sh), modification of startup scripts (e.g., /etc/rc.d/cron), and execution of binaries from world-writable directories by cron or system daemons. This rule is designed to identify the footprint of known Linux-based persistence mechanisms associated with service account exploitation.
This rule detects the modification or creation of sensitive Linux files often used for persistence, such as cron job configurations, system boot scripts, and custom system tools. It monitors for file writing and process execution events involving specific paths and filenames identified as associated with persistence mechanisms or monitoring tools.
Detects potential privilege escalation and unauthorized file modification by the 'egnyteservice' account. The rule monitors Syslog for sudo usage involving the 'tee' utility with 'NOPASSWD' configuration, or suspicious writes to critical system directories such as /usr/sbin/ and /etc/cron.d/, which are indicative of VerdantBamboo threat actor activity on edge appliances.
Detects suspicious command execution on Linux-based SOHO/IoT devices, specifically targeting patterns associated with log deletion, unauthorized cron job modification, busybox utility abuse, and temporary directory execution. This activity is often linked to botnet recruitment and reconnaissance behaviors such as those observed in the JDY and Volt Typhoon campaigns.
Detects execution of persistence-related commands such as cron job modifications or SSH key additions originating from development-related parent processes or installation commands like npm/pip. This behavior is indicative of potential supply chain compromises or malicious actors abusing development environments to maintain access.
Detects unauthorized or suspicious modifications to critical Linux configuration directories (e.g., cron, rc, init, ipsec) or specific application-related paths by processes not typically associated with system management or package maintenance. The rule further elevates risk when specific indicators like LD_PRELOAD, LD_LIBRARY_PATH, or known malicious string artifacts are present in the command line or file path.
Detects post-exploitation activities related to the CVE-2026-45257 BUMSRAKETE vulnerability on FreeBSD. The rule monitors for kernel module loading using kldload from suspicious directories, kldstat execution, unauthorized root-level crontab modifications, and suspicious root-level shell execution spawned from non-standard parent processes, all of which indicate potential persistence or rootkit installation following a local privilege escalation.
Detects suspicious execution patterns originating from or associated with crontab, crond, or anacron processes. The rule identifies potential persistence or malicious task scheduling by monitoring specific command-line indicators such as execution from /tmp or /dev/shm, unusual execution intervals, or specific shell command patterns associated with cron job abuse.
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
This rule detects persistence mechanisms and fileless execution patterns commonly associated with the MYRA malware family on Linux systems. It specifically monitors for malicious cron job creation, LD_PRELOAD library manipulation, unauthorized shell profile modifications, and memfd-based execution spawned from Node.js or npm processes.
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
This rule detects potentially malicious activity related to the cron utility, including the modification of cron-related configuration files and the execution of specific suspicious payloads (e.g., ssync.sh, blacklist). It monitors for file creation, modification, or renaming events within sensitive directories, as well as the spawning of processes by cron daemons using identified suspicious paths or command names.
Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.
Detects MYRA Linux RAT persistence mechanisms. The rule monitors for the creation of cron jobs scheduled to run every 13 minutes and the creation of a profile initialization script at /etc/profile.d/.sh.local, which is a common technique for ensuring code execution upon user shell session initialization.
This rule detects potentially malicious activity related to cron job scheduling. It monitors for three distinct stages: (1) direct modification of crontab files or directories using common shell utilities, (2) suspicious file write operations to critical cron configuration paths, and (3) execution of shell scripts or binaries from unusual directories (e.g., /tmp, /dev/shm) where the parent process is a cron utility.
Detects cron-based watchdog persistence installed by lambsys.elf as part of the CVE-2026-33017 Langflow cryptominer campaign. The malware writes a per-user crontab via crontab stdin firing every 5 minutes, checking for lambsys via pgrep and re-downloading from C2 if absent, logging to /var/tmp/check_process.log.
Detects when a non-root user modifies, creates, or renames files within common cron directories or the main crontab file on Linux systems. This activity can indicate an attempt to establish persistence or schedule malicious tasks.
Detects potential persistence attempts via cron job manipulation by unprivileged service accounts (such as www-data) or patterns indicative of the 'lambsys' threat, including usage of known writable temporary directories, non-interactive crontab installations, and aggressive execution schedules.
Detects unauthorized cron job creation or modification associated with cryptominer persistence. The rule monitors for common persistence indicators such as referencing 'lambsys', 'isp.sh', or 'procq' within cron-related commands and shell execution patterns that suggest malicious automated tasks in Linux environments.
Detects unauthorized modifications to cron jobs or RC scripts on Linux and BSD edge appliances, which is a persistence technique observed in the VerdantBamboo BRICKSTORM campaign. The rule flags suspicious file modifications in persistence-related directories, excluding activity from legitimate package managers.
Detects instances where a Node.js process spawns the 'crontab' utility, likely to modify user cron jobs. This is a common technique used by attackers to achieve persistence by scheduling periodic execution of malicious scripts or reverse shells.
Page 5 of 8