Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
90 detections
Filters
Last updated
All Time
Detection languages
35
23
11
9
4
Contributors
26
21
20
3
3
Categories
44
39
38
27
17
Platforms
50
44
40
30
19
Products / Services
23
18
16
14
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
3
3
3
IDS Classtypes
9
6
6
2
IDS Protocols
22
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints, indicative of credential harvesting.
This query identifies potential post-exploitation behavior on Linux systems by monitoring for clusters of discovery and enumeration commands. Instead of alerting on single, potentially benign commands, it utilizes a behavioral scoring engine that categorizes activities such as credential hunting, privilege escalation, and network scanning.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
Detects when a Managed Identity successfully authenticates via the Azure Instance Metadata Service (IMDS) and subsequently performs administrative or enumeration actions within a short timeframe. This pattern can indicate an attacker has compromised a resource (e.g., a Virtual Machine) and is using its Managed Identity to move laterally or access other resources within the Azure environment. The rule correlates successful IMDS-based sign-ins with subsequent activities such as running commands on virtual machines, or listing/getting secrets and keys from Key Vaults, or other general administrative/alert-generating activities.
This rule detects various behaviors associated with the VoidLink threat, focusing on persistence, privilege escalation, and evasion techniques. It identifies suspicious kernel module loading from temporary directories, the presence of hidden rootkit files, container escape attempts, and cloud metadata harvesting. The rule correlates these activities to reduce false positives, specifically looking for combinations such as suspicious module loads with hidden rootkit files or container escapes, container escapes with cloud metadata harvesting, hidden rootkit files with container escapes or cloud metadata harvesting, and eBPF evasion techniques combined with suspicious module loads or hidden rootkit files. The detection logic suggests an adversary attempting to establish persistence, elevate privileges, and potentially exfiltrate cloud credentials within a Linux environment, possibly involving containerized setups.
Page 5 of 5