Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule monitors for modifications to critical Name Service Switch (NSS) configuration files (/etc/nsswitch.conf) or the creation/loading of NSS shared library files (/lib/libnss_*.so). Adversaries may target these files to manipulate identity management, gain persistence, or escalate privileges by intercepting authentication requests.
Detects suspicious activity involving the uptime utility on Linux systems. This includes execution from non-standard paths, invocation with unexpected command-line arguments, execution with unusual parent processes, or evidence of the uptime binary being overwritten or written to a non-standard location. Such behavior is often indicative of masquerading or attempts to hide malicious activities.
Detects instances where the Windows Subsystem for Linux (WSL) process (wsl.exe) is used to execute native Windows command-line interpreters or utilities. This behavior is often associated with attackers using WSL as a living-off-the-land technique to evade security monitoring, run obfuscated payloads, or bypass execution restrictions by crossing the Linux/Windows boundary.
Detects the deployment and execution of GS-Netcat (gsocket), a tool often used for creating persistent reverse shells or backdoors. The rule identifies processes associated with gsocket, instances where the 'uptime' command is masqueraded with suspicious command-line arguments, and unauthorized creation or modification of systemd service files designed for persistence.
Detects potential credential harvesting activities targeting the SSH and PAM authentication stacks. The rule identifies suspicious file operations (creation/modification/read) by authentication-related processes (sshd, login, su, sudo) involving sensitive files like /etc/shadow or non-standard file paths in temporary directories, as well as the spawning of interpreters that write to these suspicious locations.
This rule detects low-frequency, external network connections originating from Linux processes that are either explicitly known to be associated with malicious tools (e.g., gs-netcat, gsocket, atlasd) or are masquerading as legitimate system utilities (e.g., uptime, smbd) in a manner consistent with the Velvet Ant Operation Highland activity. The detection aggregates connections by process metadata and flags low-frequency outbound traffic, which is indicative of C2 beaconing.
This rule detects potentially malicious or masqueraded Samba (smbd) activity on Linux systems. It monitors for three conditions: smbd processes launched from non-standard binary paths, smbd process network activity from non-standard binary paths, and smbd processes spawned by unauthorized or unexpected parent processes. These patterns are often associated with unauthorized SMB service deployment, malware persistence, or masquerading techniques.
Detects potential tampering with Pluggable Authentication Modules (PAM) or configuration files on Linux systems. This includes the loading of non-standard shared libraries by authentication-related processes (sshd, sudo, login), modification of core PAM modules (e.g., pam_unix.so) by non-package manager processes, and unauthorized modifications to files within /etc/pam.d/. It also monitors for credential-related activity where authentication processes write data into temporary or hidden directories.
Correlates the RMM shell modifying the fDenyTSConnections registry key to force-enable Remote Desktop Protocol for interactive lateral movement.
Detects a suspicious file deletion event where a JSE script is deleted from the Downloads directory by wscript.exe or cscript.exe. This activity is indicative of the Kimsuky threat group's NUKESPED dropper cleaning up its own artifact after execution to avoid forensic detection.
Detects the Kimsuky threat group using a JSE-based loader to write decoded binary payloads to the C:\ProgramData directory. The files are written using randomized filenames with specific non-standard extensions (.a9oc, .lpXD, .lpxQ, .lpXO) initiated by wscript.exe or cscript.exe, a technique observed in their January 2026 campaign.
Detects potential timestomping activity using PowerShell Set-ItemProperty, as well as specific file metadata manipulation and file operations associated with the JFMBackdoor utilizing fltMC.exe.
Detects the suspicious execution of fltMC.exe or the loading of FLTLIB.dll from temporary directories, which is a known behavior of JFMBackdoor malware. It also detects known SHA256 hashes associated with this threat.
This rule detects suspicious process execution chains associated with known Kimsuky campaign activity and NUKESPED malware. It identifies the execution of the NUKESPED secondary payload 'zlrenu8.exe' and a specific sandbox-evading JSE loader chain where WScript or CScript spawns hidden PowerShell instances using 'certutil' to decode files stored in the ProgramData directory.
Detects the Showboat Linux malware which hides its presence by masquerading as a kernel worker process. This is identified by a process with 'kworker' in its name or command line that originated from a resolvable on-disk binary path, which is characteristic of user-space processes rather than legitimate kernel threads.
Detects the Kimsuky NUKESPED JSE loader anti-analysis pattern. The rule monitors for wscript.exe executing a JSE file, followed by a delayed PowerShell execution containing hidden window flags, decoding or non-interactive flags, and references to ProgramData, which is consistent with sandbox evasion and NUKESPED payload staging.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
This rule detects instances of the JFMBackdoor malware performing timestomping operations within the 'C:\Users\public\jfm\' directory. The malicious activity involves the use of fltMC.exe to perform DLL sideloading, followed by modifying file timestamps to evade forensic analysis and timeline reconstruction, specifically observed as part of the Red Lamassu command 0xE subcommand 0x10.
Detects the execution of WMI queries or hidden PowerShell commands initiated by JScript/VBScript interpreters (wscript.exe/cscript.exe), a behavior characteristic of Kimsuky's NUKESPED loader for performing anti-analysis and sandbox evasion.
This rule detects instances where PowerShell is spawned by Windows Script Host processes (wscript.exe or cscript.exe) with suspicious command-line arguments indicative of fileless execution or payload decoding, such as the use of hidden windows, encoded commands, or certutil-based file decoding from the ProgramData directory.
Detects instances where the creation timestamp of a file is reported as being significantly older (more than 30 days) than the actual file creation event time, as recorded by Sysmon Event ID 2. This is a common indicator of timestomping, where attackers modify file creation metadata to evade detection or blend in with legitimate system files.
Page 311 of 864