Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects outbound web requests directed at public NPM mirrors and CDNs (unpkg, npmmirror, yarnpkg, jsdelivr) that contain strings matching known malicious package names associated with the 'Beamglea/ClickFix' campaign. This activity is typically indicative of a victim visiting a deceptive Cloudflare CAPTCHA phishing page designed to execute malicious scripts in the browser.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option.
This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred.
If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host.
Immediate investigation and response are crucial to mitigate potential damage.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option.
This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred.
If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host.
Immediate investigation and response are crucial to mitigate potential damage.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
Detects the presence of the 'Mushr00w' PHP web shell, typically associated with exploitation of vulnerabilities in WordPress plugins such as Super Forms or Elementor Pro. The rule looks for identifying strings within the file, including specific filenames, HTML title tags, and common PHP file upload function signatures used by this shell.
This rule detects attempts to exploit a vulnerability in the WordPress Super Forms plugin (CVE-2026-14894). The rule monitors for malicious file upload requests containing embedded PHP code or attempts to bypass filename extensions for PHP files via the super_submit_form AJAX action.
Detects a malicious HTTP POST request targeting the Elementor Pro WordPress plugin's 'elementor_pro_forms_send_form' action. The rule looks for a specific attempt to bypass file upload restrictions by manipulating the array index of form fields to upload a PHP file via the 'admin-ajax.php' endpoint.
Detects the creation of PHP files within the 'wp-content/uploads/elementor/forms/' directory of a WordPress installation. This behavior is highly suspicious as it often indicates an attempt by an attacker to deploy a web shell or other malicious script following successful exploitation of the Elementor plugin, which allows for arbitrary file uploads.
Detects the initialization of PostgreSQL logical replication slots using uncommon or unrecognized output plugins. Attackers may leverage logical replication plugins to exfiltrate data from a database by streaming changes as they occur, which can be an alternative to traditional mass-export techniques.
Detects modifications to the PostgreSQL configuration file 'pg_hba.conf' closely followed by a reload command (via pg_ctl or postgres processes). This behavior is indicative of an attacker attempting to modify authentication or connection access controls for a database.
This rule detects potential persistence mechanisms in a PostgreSQL database by identifying the creation of a new shared library file (e.g., .so or .dll) within PostgreSQL plugin directories, followed by a modification to the PostgreSQL configuration files (postgresql.conf or postgresql.auto.conf) within a short 30-minute window. This behavior is indicative of an attacker registering a malicious shared library to be loaded upon database startup, a technique associated with PostGREShell-style post-exploitation.
Detects the creation or modification of specific files within the /tmp directory, specifically those matching naming patterns associated with 'jasper-log' files or temporary pipe files. These patterns are often associated with temporary storage or data staging activities during post-exploitation or malware execution.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects the creation or modification of a specific file ('libvirtlog.so.0') located in '/usr/lib/' which acts as a gating mechanism for the curlRAT malware. The detection correlates this file event with processes commonly associated with system management that are executing with command line arguments indicative of malicious activity (e.g., 'reverse', 'pty').
Detects the use of common Linux command-line utilities (sed, grep, awk, bash, sh) to perform operations on sensitive system logs or shell history files. The rule targets command strings indicative of log modification, filtering, or removal of audit trails, often associated with an attacker attempting to conceal malicious activity.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.
Detects network connections from common Linux system binaries (agetty, atd, polkitd, crond) to identified suspicious external domains. These binaries typically do not communicate with external internet services, suggesting potential process masquerading or compromise.
Detects the creation or modification of files within the /tmp directory that follow a specific naming convention (t[number]_w.pipe) by an HAProxy process. This pattern is often associated with inter-process communication or potential post-exploitation activity where HAProxy is leveraged to handle named pipes for malicious command execution or data redirection.
Detects outbound web requests directed at public NPM mirrors and CDNs (unpkg, npmmirror, yarnpkg, jsdelivr) that contain strings matching known malicious package names associated with the 'Beamglea/ClickFix' campaign. This activity is typically indicative of a victim visiting a deceptive Cloudflare CAPTCHA phishing page designed to execute malicious scripts in the browser.
Page 120 of 341