Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
This rule monitors Syslog entries for PostgreSQL 'CREATE_REPLICATION_SLOT' commands to identify potential exploitation attempts associated with CVE-2026-6471. It detects attempts to load logical decoding plugins using suspicious path structures, including path traversal sequences ('../', '..\'), absolute paths, or UNC paths, which are not present in a known-good allowlist of plugins.
This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.
Detects the use of common Linux command-line utilities (sed, grep, awk, bash, sh) to perform operations on sensitive system logs or shell history files. The rule targets command strings indicative of log modification, filtering, or removal of audit trails, often associated with an attacker attempting to conceal malicious activity.
Detects instances where LiteLLM, or related Python application processes (uvicorn, python), spawn a shell or command-line utility (bash, sh, id) under the root user account. This behavior is indicative of potential container breakout, application exploitation, or privilege escalation attempts originating from a web-accessible service.
Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.
Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
This rule detects when common web server service accounts (e.g., www-data, apache) spawn Unix shell processes (sh, bash, dash) to execute system enumeration commands like 'id' or 'whoami'. This activity is often a sign of post-exploitation behavior following successful web application exploitation, where an attacker attempts to determine their context and privileges on the compromised host.
This rule detects when common web server service accounts (e.g., www-data, apache) spawn Unix shell processes (sh, bash, dash) to execute system enumeration commands like 'id' or 'whoami'. This activity is often a sign of post-exploitation behavior following successful web application exploitation, where an attacker attempts to determine their context and privileges on the compromised host.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
Page 12 of 51