Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects a Node.js process termination followed by a quick respawn of a new Node.js process by the same parent process. This pattern suggests a watchdog persistence mechanism where the parent process monitors the child, automatically restarting it if it is terminated, consistent with behaviors observed in malware such as Void Dokkaebi.
This rule detects potentially malicious database manipulation by monitoring process execution command lines for commands that drop critical databases or toggle foreign key checks. It flags instances where multiple drop database commands occur or foreign key constraint toggling is detected, which is often indicative of automated data destruction or ransomware activity within database environments.
This rule monitors process command lines and file operations for specific strings associated with ransomware, including known ransom note naming conventions ('readme_ransom'), a specific Bitcoin wallet address, a contact email, and SQL commands commonly used to drop database tables for ransom purposes.
Detects execution of gsocket-related tools (gs-netcat, gsocket, gs-sftp) or command-line patterns typically used for remote shell access or socket redirection, such as using -e with a shell, -l/-p for listening, or redirecting I/O from common temporary directories.
Detects build process content (likely within a Dockerfile or CI/CD script) that installs 'netcat' and initiates a multi-architecture build and push operation to a specific container registry path (registryfr.azurecr.io/mongo:latest), which may indicate the creation of a backdoored or malicious container image.
Detects execution of 'npm install' or 'npm ci' commands that explicitly include '@marketfront' or '@tqm-mfe' scopes. This detection is designed to identify potential dependency confusion attacks where malicious actors publish public packages with the same names as internal private packages to trick build systems into downloading malicious code instead of legitimate internal modules.
This rule detects when a user containing the name "admin" in the username fails to log in via SSH.
This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity.
However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity.
However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
Detects iptables INPUT/PREROUTING NAT rule insertions that ACCEPT inbound TCP traffic on a specific port, matching DOGLEASH's deployment script behavior of opening a firewall hole for its backdoor listening port.
This rule detects unauthorized or suspicious access attempts to a MinIO storage service by monitoring network traffic for default credentials, specific API calls like 'ListBuckets', or access to sensitive paths like 'terraform-state'. It triggers when traffic either targets the 'minio.internal' hostname or the local loopback address on port 9000, specifically looking for common MinIO administrative indicators.
Detects execution of processes using 'LOAD_FILE' (often associated with MySQL or specific command-line utilities) to attempt to read sensitive container-related paths such as '/var/run/docker.sock' or '/proc/1/cgroup'. This behavior is indicative of an attacker attempting to gather information for container escape or environment reconnaissance.
Detects unauthorized access to sensitive credential files, such as credentials.json or .env, through HTTP GET requests, or the creation/staging of a credentials file at /tmp/creds.json, which may indicate attempts to exfiltrate or steal credentials from the local system.
day3 ProgLangs
YARA
These YARA rules detect the presence of compiled executables written in Rust, Golang, or Nim by matching specific language-related artifacts, such as compiler-generated metadata, runtime library paths, or symbol patterns within Windows PE or Linux ELF binaries.
This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.
Detects the use of Git commands (filter-branch, rebase -i, or force-push) that rewrite local or remote commit history. These operations are often used by adversaries to hide malicious code injections, remove evidence of unauthorized changes, or manipulate developer repository integrity.
Detects file system artifacts indicating installation of the malicious 'ascii-fetcher' VS Code extension (v1.0.0) from the Open VSX marketplace, which bundles the malicious npm dependency '@jaymara/jsononifier' to hide its logic from static analysis.
Detects instances where the same file (identified by SHA256) with common lure names like 'resume', 'headshot', or 'faceswap' is being created or modified by multiple different users across the environment. This behavior is often indicative of an adversary distributing malicious files or a coordinated effort to access sensitive or tempting filenames, potentially related to social engineering or lateral movement.
Detects OS fingerprinting commands executed as child processes of a process that is actively listening on a network port, consistent with DOGLEASH.
This rule detects suspicious activity where a process initiates a network listening connection, launches a shell (sh, bash), and engages in file read or rename operations within a short 15-minute window. This behavior is indicative of a potential backdoor setup, lateral movement, or malicious script execution.
Detects execution of Node.js applications that utilize specific Jscrambler obfuscation versions or the presence of these versions in package.json files, which may indicate the use of compromised or unauthorized supply chain dependencies.
This rule detects the execution of mitmproxy, mitmweb, or mitmdump in reverse-proxy mode configured specifically to target login.microsoftonline.com. This behavior is highly characteristic of an adversary setting up an Adversary-in-the-Middle (AiTM) platform to perform TLS interception on authentication traffic, potentially leading to credential and session cookie theft.
This rule monitors for the creation of files containing the string 'readme_ransom' or the execution of processes that reference 'readme_ransom', specific known ransomware wallet addresses, or associated contact email addresses, which are indicative of post-encryption ransomware activity.
Page 164 of 347