Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of cron jobs that utilize file transfer utilities (curl, wget) piped directly into a shell (sh, bash). This is a common "living off the land" technique used by attackers to fetch and execute remote malicious payloads for initial staging and persistence.
Detects Python command lines referencing the specific authencesn cryptography string used to exploit the Copy Fail vulnerability (CVE-2026-31431).
Usermod to root
Sigma
Detects the use of the usermod to modify the users permissions.
Which can be an indication of privilege escalation attempts on Linux systems
Which can be an indication of privilege escalation attempts on Linux systems
Detects potential remote code execution (RCE) via CVE-2026-55200 in libssh2-linked applications. The rule monitors for two signals: firstly, a post-exploitation child process (such as a shell or interpreter) spawned by a common libssh2-reliant application (e.g., ssh, curl, git, php) shortly after an outbound connection to TCP ports 22 or 2222; secondly, anomalous outbound network connections to port 2222 originating from these same libssh2-linked binaries.
This rule identifies endpoints that have transferred a total of more than 50MB of data to a single external, non-private IP address. The detection filters out RFC1918 private subnets and local loopback traffic, aggregating byte counts and connection attempts per endpoint, computer, and destination. This is indicative of potential data staging or exfiltration activities.
Detects large outbound network transmissions occurring on a host shortly after the creation of staged or archive files. This behavior is indicative of an attacker consolidating sensitive data (such as credentials or intelligence) into an archive and subsequently exfiltrating it over a Command and Control (C2) or other established network channel.
Detects network connection events where the requested URL contains 'dogleash' and includes common architecture suffixes (mips, arm, x64) or shell script extensions (.sh), often indicative of downloading stage payloads associated with the Dogleash malware family.
Detects zip archives matching the .zx_ filename prefix convention used by CrashStealer to stage encrypted exfiltration data in /tmp prior to transmission to its C2 server.
Detects processes that execute commands involving SQL database operations, specifically those related to AES encryption functions or table management (create/drop operations) on configurations. This activity is often associated with potential database manipulation or data destruction attempts by an attacker.
This rule monitors for the execution of the 'pg_dump' utility by Python-based applications (like Langflow), followed by the deletion of a file on the same host within 60 minutes. This behavior may indicate an adversary staging data, dumping a database, and then attempting to remove evidence of the activity.
This rule detects Python processes initiated or executed in association with 'langflow'. It flags instances where Python is invoked with command-line arguments containing Base64 decoding patterns or '-c' flags, which are commonly used by attackers to execute obfuscated or staged payloads within a Python environment.
Detects the usage of the 'docker cp' command containing directory traversal sequences ('../') in the destination argument. This behavior is associated with a known container escape technique where an attacker can overwrite files on the host filesystem by escaping the container's designated storage path.
Detects anomalous internal network activity where a single host attempts to connect to multiple unique internal IP addresses across various ports within a short timeframe. This behavior is indicative of lateral movement reconnaissance or port scanning within the internal network.
This rule detects the execution of Python or MySQL command-line utilities where the command line contains strings indicative of 'mysql.func'. This pattern is often associated with the loading of malicious UDFs (User Defined Functions) or other exploitation techniques targeting database environments through script interpreters.
This rule monitors process command lines for strings associated with sensitive API keys (e.g., OpenAI, Alibaba, Huawei, Tencent, Aliyun) or seed phrases. It triggers an alert when two or more distinct patterns are identified on the same host, indicating potential credential harvesting or discovery activities.
Detects command-line execution of database drop operations combined with the disabling of foreign key constraints, which is indicative of malicious database manipulation or automated data destruction attempts.
Detects the execution of Python processes via the command line that include both the '-c' flag for executing inline code and specific code patterns related to network data retrieval ('urllib.request.urlopen') or decoding obfuscated data ('base64.b64decode'). This behavior is commonly used by adversaries to download and execute secondary payloads or handle C2 communication.
This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.
This rule detects processes that load Pluggable Authentication Modules (PAM) libraries (libpam) and subsequently initiate network connections within a 30-minute window. This behavior is often associated with credential dumping tools or malicious implants attempting to exfiltrate cached credentials or session information from memory on Linux and macOS systems.
Detects the execution of OS information gathering commands (e.g., uname, lsb_release) by a process that is also identified as having an active network listener. This pattern is indicative of passive backdoors or C2 agents performing reconnaissance of the host system after establishing a listener.
Detects the DOGLEASH backdoor utilizing /bin/sh -c to execute arbitrary shell commands. The detection specifically looks for the execution of the Unix shell with -c arguments triggered by parent process command lines containing specific C2 command codes (0x2268 or 0x2267).
Page 165 of 347