Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
164 detections
Filters
Last updated
All Time
Detection languages
77
32
13
10
9
Contributors
55
38
13
9
8
Categories
104
95
87
64
61
Platforms
155
16
9
5
4
Products / Services
99
49
27
14
11
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
3
1
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.
This rule detects the execution of specific shell processes (sh, bash, crontab) where command-line arguments reference suspicious paths commonly associated with persistence mechanisms or malware, such as /var/tmp/ files or crontab spool directories.
Detects the creation of persistence mechanisms, specifically cron jobs or LaunchAgent plist files, initiated by the OpenClaw agent process tree (openclaw, openclaw-runtime, openclaw-agent). This behavior is associated with ClawHub skills attempting to maintain C2 access after the skill itself has been removed.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
Detects persistence mechanisms associated with the MYRA RAT on Linux systems, including the creation or modification of cron jobs (specifically targeting .cache-update.sh), registration of a malicious shared object via /etc/ld.so.preload, and the installation of a login hook in /etc/profile.d/.
This rule detects various techniques used by the Lambsys malware for persistence, watchdog monitoring, and cryptocurrency mining on Linux systems. It monitors for crontab modifications, the execution of hidden watchdog scripts in /var/tmp, the usage of pgrep to monitor the miner, and the detachment of processes via nohup.
Detects persistence mechanisms used by the lambsys/procq cryptominer. It identifies two specific behaviors: 1) Correlation of non-root process execution (isp.sh, lambsys, procq) followed within 120 seconds by modifications to cron configuration files (e.g., /etc/cron.d/, /var/spool/cron/crontabs/) containing suspicious command-line patterns or mining pool references. 2) Direct detection of crontab -e invocations using heredoc redirection (<<) to install persistence payloads that match known miner dropper patterns and mining pool endpoints.
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
Detects indicators of persistence activity associated with the MYRA RAT. This includes unauthorized modifications to shared library preload mechanisms (/etc/ld.so.preload), creation of malicious shared objects in systemd user paths by common interpreter/shell processes, suspicious modification of cron job files by those same processes, and the execution of the 'systemd-userdbd' process from non-standard, unauthorized filesystem locations.
Detects persistence mechanisms associated with the MYRA Linux RAT, including LD_PRELOAD hijacking for shared library redirection, malicious cron job creation with specific scheduling (13-minute intervals), and unauthorized modifications to profile.d scripts to execute malicious code.
This rule detects suspicious activity related to Node.js applications that may indicate malicious manipulation of the environment or persistence mechanisms. It monitors for the loading of a specific hidden library (.libcache.so), usage of the LD_PRELOAD environment variable by node/npm processes, modifications to profile scripts, and irregular crontab entries associated with node execution. This behavior is indicative of dynamic linker hijacking or unauthorized task scheduling for persistence.
Detects when a non-root user modifies, creates, or renames files within common cron directories or the main crontab file on Linux systems. This activity can indicate an attempt to establish persistence or schedule malicious tasks.
This rule detects potentially malicious cron job activity, including modifications to crontab files, execution of cron jobs from world-writable directories (such as /tmp or /dev/shm), and the usage of unusual prime-number timing intervals which are commonly used by attackers to evade standard scheduling patterns.
This rule detects multiple indicators of suspicious activity on Linux systems, including LD_PRELOAD hijacking, memfd_create fileless execution, suspicious process masquerading, periodic cron task execution, and the creation of configuration files associated with common IDEs and AI tools. These patterns are frequently used to establish persistence, hide malicious activity, or facilitate lateral movement by compromising development environments.
Detects MYRA Linux RAT establishing cron-based persistence by scheduling /usr/local/lib/.cache-update.sh to execute every 13 minutes with a fileless fallback chain using memfd_loader and agent_launcher. Indicative of the apintergrationpost npm supply chain attack by threat actor kimijohn01.
Detects suspicious cron utility activity, including modifications or executions, with specific indicators associated with the MYRA malware family. This rule identifies attempts to establish persistence or execute malicious code via scheduled tasks on Linux systems.
Detects piping 'echo' directly into 'crontab -' to install cron jobs non-interactively, a standard method for scripted persistence.
Detects cron job creation for Linux persistence or execution
Detects when scripting language interpreters (Node, Python, Bun, NPM) create or modify files within the '/etc/cron.d/' directory. This activity is suspicious as it may indicate a compromised package or malicious actor attempting to establish system-wide persistence via scheduled tasks.
Detects if the backdoor file 'install-persistent.php' is scheduled for persistence via cron or Windows scheduled tasks. This indicates a potential supply chain compromise targeting ShapedPlugin.
Page 6 of 8