Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,665
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
This rule detects high-frequency account and email address enumeration attempts. It monitors syslog data for SMTP commands such as VRFY, EXPN, or RCPT TO, and analyzes Microsoft Entra ID (SigninLogs) for authentication failures specifically associated with error code 50034 (user not found). Both behaviors are indicative of an adversary attempting to validate user identities within an environment, often as a precursor to targeted phishing or brute-force attacks.
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
Detects the execution of PostgreSQL dump utilities (pg_dump, pg_dumpall) initiated directly by application-level processes like Langflow or Python, rather than through standard system-level task schedulers. This behavior is indicative of unauthorized data collection or staging of database contents by an application process.
Detects the execution of PostgreSQL dump utilities (pg_dump, pg_dumpall) initiated directly by application-level processes like Langflow or Python, rather than through standard system-level task schedulers. This behavior is indicative of unauthorized data collection or staging of database contents by an application process.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects the PoisonedRefresh implant's UNIX domain socket backdoor by (1) file activity on the uniquely-named /run/bigtlog.pipe socket initiated by an Apache/httpd process, and (2) process command lines containing the implant's hardcoded authentication token. Removed the earlier generic 'bash spawned by httpd' heuristic, which fired on legitimate CGI/mod_php/admin automation that shells out from the web server and was the dominant false-positive source.
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Detects the presence of a specific sentinel string 'data.external.telemetry' within Terraform provisioner job logs, which indicates the execution of unauthorized data-collection logic within a compromised or backdoored Terraform module.
This rule detects attempts by users to disable or clear command line history logs for shell environments, including PowerShell (e.g., modifying PSReadLine history) and Unix-like shells (e.g., unset HISTFILE, setting HISTSIZE to 0, or disabling history collection). Such actions are frequently performed by adversaries to hinder incident response and forensic analysis by obscuring their post-exploitation activity.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Rileva l'esecuzione di un binario denominato acpid da un percorso diverso da /usr/sbin/acpid, tecnica di masquerading osservata in toolkit di persistenza Linux.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects instances where the Gradle or Gradlew build process launches a shell command, which may indicate a malicious build hook or dependency-based execution of arbitrary code within the software supply chain.
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
Page 15 of 51