Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects gem packages containing a .yardopts file linking to attacker-controlled Ruby scripts abused for RCE during RubyDoc.info documentation builds
Detects gem packages containing a .yardopts file linking to attacker-controlled Ruby scripts abused for RCE during RubyDoc.info documentation builds
Detects Ruby source files containing a hardcoded RubyGems API key (rubygems_ prefixed token) used for unauthorized gem publish/push actions, as seen in the yardxabc889 package from the GemStuffer campaign
Detects Ruby source files containing a hardcoded RubyGems API key (rubygems_ prefixed token) used for unauthorized gem publish/push actions, as seen in the yardxabc889 package from the GemStuffer campaign
Detects the creation or modification of specific dropper/loader files and service worker registration within WordPress directory structures (wp-content/plugins, wp-content/themes, wp-content/uploads). These files are often associated with the injection of malicious scripts (e.g., on-chain resolvers) to facilitate drive-by compromises by site visitors.
This rule detects browser activity where a page rendered via a data blob loads a sandboxed iframe containing cross-origin content originating from cdn.bloom.io. This pattern is consistent with known phishing delivery mechanisms often used in DocuSign or Teams-themed phishing campaigns to facilitate credential theft or secondary payloads.
Detects instances where the Gradle or Gradlew build process launches a shell command, which may indicate a malicious build hook or dependency-based execution of arbitrary code within the software supply chain.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
Page 112 of 347