Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
111 detections
Filters
Last updated
All Time
Detection languages
54
23
7
6
6
Contributors
38
26
8
5
4
Categories
61
58
51
45
31
Platforms
106
12
3
1
1
Products / Services
63
23
20
11
8
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
1
1
1
IDS Classtypes
1
IDS Protocols
1
Phantom Bot Systemd Service Persistence
Cortex XDR
Detects Linux persistence mechanisms specifically associated with the creation or execution of the 'phantom-bot.service' systemd service, used by the axois-utils phantom bot to execute DDoS attacks. The rule looks for process creation events on Linux where the command line contains 'phantom-bot.service' and the process name is 'sh', 'bash', 'systemctl', or 'node'.
This rule detects the execution of SUID binaries by a non-root user, immediately followed by the creation of a persistence mechanism such as a systemd service file or a cron job. This correlation aims to identify potential privilege escalation attempts where an attacker uses an SUID binary to gain elevated privileges and then establishes persistence on the system.
Detects file creation or modification events targeting /etc/systemd/system/persist.service, or the execution of 'systemctl enable persist'. This persistence mechanism is used by the Nexcorium Mirai variant to ensure the botnet survives reboots.
Detects systemctl commands enabling or starting a service named 'sysupdate', which Canis C2 uses to masquerade as a legitimate system update process and maintain persistence on Linux systems. The service restarts every 30 seconds.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
Detects malicious/suspicious systemd generator files for persistence mechanisms
This rule detects the creation of specific files associated with the TeamPCP malware's systemd persistence mechanism. It looks for the creation of '/.config/sysmon/sysmon.py' or '/.config/systemd/user/sysmon.service' which are used to maintain access and download further stages via C2 even if the original vulnerable litellm process terminates.
Detects malicious/suspicious systemd generator files for persistence mechanisms
Detects file creation events for the TeamPCP systemd persistence mechanism, specifically looking for 'sysmon.py' or 'sysmon.service' dropped in hidden user config directories. This persistence mechanism ensures the attacker maintains access and can download further stages via C2 even if the original vulnerable litellm process terminates.
Detects the creation of a malicious Python script (`sysmon.py`) within the user's systemd directory. This specific file and path are utilized by the TeamPCP compromised Trivy binary to establish persistence on developer machines when the GITHUB_ACTIONS environment variable is not set to "true".
Detects malicious/suspicious systemd generator files for persistence mechanisms
Monitors for command-line activity indicating the addition of SSH keys to authorized_keys files or the modification of the SSH daemon configuration to permit root login on Cisco SD-WAN devices. This is a common persistence technique used by attackers after gaining initial access, such as through CVE-2026-20127.
Detects creation or modification of a systemd service file referencing xapt or related artefacts,
consistent with reported GRIDTIDE Linux persistence patterns.
consistent with reported GRIDTIDE Linux persistence patterns.
Detects creation of malicious init.d scripts for persistence
To accompany Hunting rule equivalent at
https://detections.ai/rules/019c91c0-b2e0-759d-a61c-78d08e1d3d99
To accompany Hunting rule equivalent at
https://detections.ai/rules/019c91c0-b2e0-759d-a61c-78d08e1d3d99
Detects the creation of systemd services used by the PCPcat malware for persistence on Linux systems.
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
Detects the start, reload or restart of a service.
Detects a creation of systemd services which could be used by adversaries to execute malicious code.
Detects the start or reload of a service on Linux systems using 'systemctl' or 'service' commands. This can be indicative of persistence mechanisms or privilege escalation attempts where adversaries modify or create services to execute malicious payloads.
This rule detects the creation of new systemd service unit files in standard systemd directories. Adversaries often create or modify systemd services to establish persistence or escalate privileges by executing malicious code at system startup or when specific events occur. The rule specifically looks for file creation events in '/usr/lib/systemd/system/', '/etc/systemd/system/', and user-specific '/.config/systemd/user/' directories, which are common locations for systemd unit files.
The analytic detects the creation or enabling of services on Linux platforms using the `systemctl` or `service` tools. It leverages Endpoint Detection and Response (EDR) logs, focusing on process names, parent processes, and command-line executions. This activity is significant as adversaries may create or modify services to maintain persistence or execute malicious payloads. If confirmed malicious, this behavior could lead to persistent access, data theft, ransomware deployment, or other damaging outcomes. Monitoring and investigating such activities are crucial for maintaining the security and integrity of the environment.
Page 5 of 6