Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects reconnaissance commands (e.g., file listing, directory enumeration) executed as child processes of the JFrog Artifactory service. This behavior is often associated with the exploitation of Artifactory plugins or misconfigured endpoints that allow arbitrary code execution, enabling an attacker to perform discovery actions.
Detects reconnaissance commands (e.g., file listing, directory enumeration) executed as child processes of the JFrog Artifactory service. This behavior is often associated with the exploitation of Artifactory plugins or misconfigured endpoints that allow arbitrary code execution, enabling an attacker to perform discovery actions.
This rule detects the creation of a .groovy file within a plugin directory related to JFrog Artifactory, followed by the execution of suspicious child processes (e.g., shell, curl, wget) by the Artifactory process within a short timeframe. This behavior is indicative of an attacker attempting to achieve remote code execution by deploying a malicious plugin.
Detects network communication with Google Sheets API endpoints that contain specific indicators of C2 behavior, such as suspicious User-Agents, specific spreadsheet cell references, or input options characteristic of automated data exfiltration or command retrieval.
Detects rapid ICMP (ping) traffic directed towards specific internal and external hosts, characteristic of the RedTail Linux malware attempting to perform network discovery or validate connectivity to command-and-control infrastructure.
Detects RedTail malware samples: UPX-packed, statically linked ELF executables across multiple architectures (x86_64, ARM, ARM64, i686, RISC-V). Requires UPX packing signature to co-occur with RedTail-specific filename strings to reduce false positives on generic UPX-packed binaries.
Detects RedTail malware samples: UPX-packed, statically linked ELF executables across multiple architectures (x86_64, ARM, ARM64, i686, RISC-V). Requires UPX packing signature to co-occur with RedTail-specific filename strings to reduce false positives on generic UPX-packed binaries.
Detects rapid, repeated execution of process control utilities (kill, strace, inotifywait, timeout) directed at monitored processes, often used by malware (such as 'redtail') to disable security monitoring, debugging, or auditing tools on Linux systems.
Detects rapid, repeated execution of process control utilities (kill, strace, inotifywait, timeout) directed at monitored processes, often used by malware (such as 'redtail') to disable security monitoring, debugging, or auditing tools on Linux systems.
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Detects a sequence of suspicious behaviors on a single host within a 1-hour window, indicative of an adversary establishing a foothold and preparing for malicious activity. The pattern involves: 1) System architecture discovery, 2) Downloading files from an external IP address, 3) Changing permissions of files in temporary directories (e.g., /tmp, /var/tmp, /dev/shm), and 4) Executing files directly from those same temporary directories.
Detects a sequence of suspicious behaviors on a single host within a 1-hour window, indicative of an adversary establishing a foothold and preparing for malicious activity. The pattern involves: 1) System architecture discovery, 2) Downloading files from an external IP address, 3) Changing permissions of files in temporary directories (e.g., /tmp, /var/tmp, /dev/shm), and 4) Executing files directly from those same temporary directories.
Detects a sequence of suspicious behaviors on a single host within a 1-hour window, indicative of an adversary establishing a foothold and preparing for malicious activity. The pattern involves: 1) System architecture discovery, 2) Downloading files from an external IP address, 3) Changing permissions of files in temporary directories (e.g., /tmp, /var/tmp, /dev/shm), and 4) Executing files directly from those same temporary directories.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects specific suspicious processes (identified by hash or path) initiating a listening network connection on non-standard ports typically associated with honeypot captures, specifically referencing Cowrie-related paths or known malicious samples.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Detects anomalous SSH sessions originating from potentially suspicious IP addresses that utilize an 'SSH-2.0-Go' banner and immediately perform file creation operations associated with the RedTail botnet (e.g., shell scripts or architecture-specific binaries).
Page 108 of 340