Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
13
9
6
5
4
Contributors
10
5
5
4
3
Categories
23
14
14
13
10
Platforms
35
10
1
1
Products / Services
10
7
5
5
4
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects a node/npm/npx process writing to a Unix shell startup file (.zshrc, .zprofile, .bashrc, .bash_profile) immediately after package install activity. STARDUST CHOLLIMA (DPRK-nexus) used stolen maintainer credentials to compromise the Axios npm package and deliver platform-specific "ZshBucket" malware, and separately injected a malicious dependency into 131 Mastra AI framework packages. Malicious postinstall scripts modifying shell profiles is a persistence mechanism consistent with this campaign's naming and delivery pattern.
Detects modifications to the .zshrc configuration file followed by shell commands interacting with the file, or the execution of commands that source the .repair-run script within a shell environment. This pattern is indicative of potential persistence mechanisms where an adversary modifies startup scripts to maintain access or execute malicious code upon shell initialization.
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
This rule detects potentially malicious command execution patterns in Linux environments. It monitors for shell commands (bash, sh, echo, tee, cat) involving base64 decoding redirected to shell configuration files (e.g., .profile) or specific patterns involving 'gs-dbus' processes, which are often used by threat actors to decode obfuscated payloads or maintain persistence.
The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
Detects creation of LaunchAgent/LaunchDaemon plists, /etc/zshenv, or SSH authorized_keys attributed to screensharingd/helpers or occurring within a Screen Sharing session window — persistence via the root file-write primitive.
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Detects creation or modification of a shell profile (.bashrc/.zshrc/etc.) containing the exact 'tensorflow hardware compatibility check' marker used by the mrmustard stealer to disguise its persistence hook.
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
Detects MYRA Linux RAT persistence mechanisms. The rule monitors for the creation of cron jobs scheduled to run every 13 minutes and the creation of a profile initialization script at /etc/profile.d/.sh.local, which is a common technique for ensuring code execution upon user shell session initialization.
This rule detects modifications to Nginx configuration files (nginx.conf, or files within conf.d, sites-enabled, or sites-available directories) by processes other than authorized system management tools (e.g., nginx, apt, ansible). It further correlates these file modifications with subsequent Nginx configuration reloads, which is a common behavior when an adversary attempts to apply malicious configuration changes to a web server.
Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.
Detects the creation of a hidden shell script file at '/etc/profile.d/.sh.local', a common persistence mechanism used by the MYRA RAT. This file is automatically executed by POSIX-compliant shells during the login process to maintain persistence on Linux systems.
Detects modification of shell profile files for command execution on login
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
Page 1 of 2