Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the use of the curl command-line utility to communicate with a specific IP address (162.0.239.85) on port 3000, specifically targeting a path associated with 'mac' tasks. This pattern is indicative of a downloader or a staged payload retrieval from an external command-and-control server.
Detects a hardcoded PEM RSA public key embedded alongside JSCeal-specific compiled V8 bytecode obfuscation artifacts, used to encrypt exfiltrated data or C2 communications
Detects HTML content that mimics Cloudflare CAPTCHA challenges to perform social engineering (ClickFix). The rule specifically identifies the combination of fake CAPTCHA UI text, connection to suspicious domains (DDR patterns), and JavaScript snippets used to fetch and execute secondary payloads or redirects.
Detects outbound web requests directed at public NPM mirrors and CDNs (unpkg, npmmirror, yarnpkg, jsdelivr) that contain strings matching known malicious package names associated with the 'Beamglea/ClickFix' campaign. This activity is typically indicative of a victim visiting a deceptive Cloudflare CAPTCHA phishing page designed to execute malicious scripts in the browser.
This rule detects potential malicious activity related to the 'gh-token-monitor' toolkit by aggregating suspicious signals across file, process, and network data sources on an individual host. It looks for the presence of specific configuration files or scripts, execution of commands associated with the toolkit or setup processes, and network connections to known command-and-control domains or IP addresses. A host is flagged if it exhibits two or more of these distinct signal categories, suggesting a high-confidence indicator of compromise.
Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects instances where a RedTail malware variant enumerates processes via the /proc filesystem to identify and terminate previous instances of itself using a kill signal.
Page 124 of 347