Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
Detects the execution of Acronis management or recovery tools (associated with cPanel, WHM, or Plesk environments) by a non-root user that results in a process running with root privileges. This pattern is indicative of potential privilege escalation by exploiting vulnerabilities in service-level utilities.
Detects instances where a non-root user executes commands containing 'acronis' alongside web hosting management keywords (cpanel, whm, plesk) while the target process user is 'root'. This behavior suggests an attempt to abuse backup software or administrative management tools to escalate privileges or perform unauthorized administrative actions.
Detects unauthorized modification of file permissions on Acronis-related files or directories, or modification of Acronis-related files by non-authorized users. This rule targets attempts to weaken file security (e.g., setting permissions to 777 or 666) or unauthorized tampering with Acronis components, which may be part of an attempt to gain persistence, escalate privileges, or evade detection.
Detects embedded CVE-2026-46300 (Fragnesia) Linux privilege escalation exploit code used by KATARU IoT malware, copied unmodified from public PoC
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects the creation of a PostgreSQL replication slot using an unrecognized or potentially malicious logical decoding plugin. Adversaries may use custom or unauthorized plugins to exfiltrate database contents or intercept replication data streams, bypassing standard monitoring for common plugins like pgoutput or test_decoding.
This rule detects administrative SQL statements (ALTER ROLE, CREATE ROLE, or GRANT) that assign the REPLICATION attribute to a database role. The REPLICATION attribute in PostgreSQL allows a user to initiate streaming replication and perform logical decoding. This is a security-sensitive privilege, as users with this attribute can potentially bypass standard access controls or, if the environment is misconfigured or vulnerable (e.g., CVE-2026-6471), potentially leverage malicious replication plugins to achieve arbitrary code execution.
Detects network connections from common Linux system binaries (agetty, atd, polkitd, crond) to identified suspicious external domains. These binaries typically do not communicate with external internet services, suggesting potential process masquerading or compromise.
This rule identifies a discrepancy between actual network connections processed by HAProxy and the corresponding entries in its server-side logs. Such inconsistencies can indicate the presence of a malicious backdoor compiled into or injected into the HAProxy process, designed to facilitate C2 traffic while evading standard monitoring by suppressing or omitting logging for those connections.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
Detects the execution of PostgreSQL dump utilities (pg_dump, pg_dumpall) initiated directly by application-level processes like Langflow or Python, rather than through standard system-level task schedulers. This behavior is indicative of unauthorized data collection or staging of database contents by an application process.
Page 13 of 51