Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
102
76
22
16
7
Contributors
67
65
42
13
8
Categories
108
61
51
46
34
Platforms
39,908
7,245
6,529
3,864
3,627
233
Products / Services
81
68
63
51
21
MITRE Techniques
97
63
44
31
19
CVEs
18
13
11
10
8
IDS Classtypes
48
11
6
5
3
IDS Protocols
33
28
14
Campaign converting compromised FortiGate firewalls into credential stealers
Campaign converting compromised FortiGate firewalls into credential stealers
Detects anomalous high-rate outbound network scanning activity (targeting numerous distinct destination IPs and ports) originating from internal SOHO or edge devices (e.g., Cisco, Ubiquiti, Draytek hardware). This pattern is consistent with compromised devices acting as nodes within a botnet, such as the JDY cluster, conducting reconnaissance.
IoT botnet malware family used for DDoS and proxy infrastructure
IoT botnet malware family used for DDoS and proxy infrastructure
Campaign converting compromised FortiGate firewalls into credential stealers
Detects indicators associated with the JDY botnet targeting SOHO and IoT infrastructure. The rule monitors for suspicious firmware update attempts to non-vendor hosts, identifies high-rate outbound scanning from edge devices, and flags devices that show re-emergence of suspicious behavior after a quiet period.
Detects the creation or manipulation of the 'troot' root-privileged backdoor account on Cisco Catalyst SD-WAN controllers, associated with the UAT-8616 exploit chain. The rule monitors for direct modification of /etc/passwd or /etc/shadow files, usage of useradd, grep operations on passwd files, and execution of su to the troot account.
This rule detects unauthorized configuration of GRE tunnels on Cisco IOS-XE network devices, potentially indicating persistent command and control (C2) channel establishment via TCL injection or illicit configuration changes involving known attacker infrastructure (62.171.185.97). It correlates network traffic to the attacker IP with process-level activity involving suspicious configuration files, scripts, or device-specific command-line arguments.
Detects exploitation attempts against LB-LINK routers via parameter injection in the 'set_LimitClient_cfg' endpoint (CVE-2023-26801) and subsequent command-and-control behavior, including outbound connections to known RondoDox staging IPs and DNS queries for associated malicious domains.
Detects signs of JDY botnet activity on Linux systems, specifically identifying shell-based payload downloads using curl or wget, or the execution of binaries directly from temporary directories, a pattern common in IoT firmware compromises.
Detects the JDY botnet's infection chain on Linux systems, characterized by script-based processor architecture reconnaissance followed by the retrieval, execution, and subsequent deletion of architecture-specific (MIPS) binaries. This rule monitors shell-based command sequences involving system information gathering, network-based file downloads, and immediate removal of the downloaded file.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects attempts to modify Cisco ROMMON firmware for deep persistence
Identifies shell commands associated with downloading architecture-specific payloads (e.g., mips, mipsel) commonly used by IoT/SOHO botnet droppers like the JDY botnet.
This rule detects HTTP traffic where the URI contains both "firmware" and "update" (case-insensitive) and the HTTP host is an IP address. This combination suggests a firmware update request originating from or destined for an unverified source, potentially indicating a malicious or unauthorized firmware update attempt.
This rule detects attempts to push malicious firmware to a device via TFTP (Trivial File Transfer Protocol). It specifically looks for UDP traffic on port 69 (TFTP) where the packet content starts with "|00 02|" (indicating a TFTP write request) and the data size is greater than 10000 bytes, suggesting a firmware image transfer.
Detects commands used to reflash component firmware for deep persistence
This rule detects attempts to overwrite router firmware via an SSH session. It specifically looks for the string "flash write" within TCP traffic directed to port 22 (SSH) on the home network. This activity is indicative of an attacker attempting to modify the router's operating system, potentially for persistence, backdooring, or other malicious purposes.
This rule detects attempts to downgrade network device firmware via SSH by looking for the string "boot system flash" in TCP traffic directed to port 22 (SSH). This command is commonly used on Cisco IOS devices to specify the system image to boot from, and its presence in an SSH session could indicate an attempt to revert to an older, potentially vulnerable firmware version or to a malicious image.
This rule detects attempts to push firmware or bootkit images to a device via a remote SSH session. It specifically looks for the commands 'dd if=' and '/dev/' within TCP traffic directed to port 22 (SSH), indicating an attempt to write data directly to a device file, which is a common method for flashing firmware or installing bootkits.
Page 10 of 12