Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
1
Contributors
3
2
1
1
1
Categories
4
2
2
2
1
Platforms
6
3
Products / Services
3
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
1
IDS Protocols
3
Detects incoming TCP and UDP traffic containing the 'sxcdewqaz!@#' magic string. This pattern is characteristic of a packet-triggered backdoor (often referred to as 'Fire Ant'), which uses custom packet payloads to activate malicious functionality on a listening host.
Detects network-based command signaling shared by the Fire Ant/REPTILE-derivative backdoor and its reverse-tunneling implant capability. Identifies the 'magic string' activation sequence and matching 'kill marker' termination sequence over TCP and UDP — indicative of packet-triggered backdoor activation, port-knocking style C2, or reverse-tunnel establishment via raw socket communication.
This rule detects a multi-stage Linux privilege escalation exploitation sequence often associated with kernel vulnerabilities (such as CVE-2023-32233). It identifies: 1) The creation of a user namespace to acquire CAP_NET_ADMIN privileges, 2) The use of 'tc' (traffic control) with 'pedit' actions by a non-root user, 3) The loading of the 'act_pedit' kernel module by a non-root user, 4) Execution of known proof-of-concept binaries (e.g., PACKET_EDIT_MEME, pedit_cow_demo), and 5) Post-exploit evidence cleanup involving the clearing of system page caches via 'drop_caches'.
Detects use of raw sockets for implementing socket filter backdoors
Detects use of raw sockets for implementing socket filter backdoors
This rule detects attempts to establish a raw socket connection that is not TCP, UDP, or ICMP. This behavior can be indicative of a socket filter backdoor, where an attacker uses raw sockets to bypass standard network stack processing and potentially sniff or inject arbitrary network traffic. The rule specifically looks for outgoing connections from the home network to any destination where the IP protocol is not 6 (TCP), 17 (UDP), or 1 (ICMP).
Detects Python processes creating AF_ALG sockets with the 'authencesn' crypto template, which could indicate exploitation of CVE-2026-31431. This rule specifically looks for Python interpreter executions on Linux systems where the command line contains both 'socket.socket(38' (representing AF_ALG family) and 'authencesn'.
This rule detects the execution of specific commands associated with the installation of the Triple Cross eBPF rootkit. It looks for commands executed via 'sudo' that contain specific 'tc' (traffic control) parameters, including 'qdisc' and 'filter', along with a network interface like 'enp0s3'. These command line arguments are characteristic of the 'deployer.sh' script used by the Triple Cross rootkit to establish persistence and hide its presence using eBPF.
