Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
483 detections
Filters
Last updated
All Time
Detection languages
151
134
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
63
Platforms
210
208
108
108
71
Products / Services
10,650
9,755
6,688
4,418
3,745
483
MITRE Techniques
100
93
87
62
54
CVEs
6
6
5
4
4
This rule detects various indicators associated with the SSHStalker botnet on Linux systems, including outbound IRC-like network connections, modifications to cron files for persistence, log tampering (specifically utmp/wtmp/lastlog files), and the execution of compilers from suspicious directories like /tmp or /dev/shm. Each section of the rule targets a specific behavior of the botnet.
This rule detects activities related to the DKnife gateway, which is associated with Adversary-in-the-Middle (AitM) attacks. It identifies the creation of specific DKnife process names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin), file events involving DKnife configuration artifacts (rules.conf, sslmm.cfg, url.cfg), and the presence of specific marker strings ("dkimsi=", "460110672021628", "PASSWORD") in logs or captured payloads. The rule aims to identify the presence and activity of DKnife components on Linux systems.
This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.
Detects attempts to deliver a Base64-encoded Java class to an Ivanti EPMM
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
This query identifies URL access attempts that were blocked by CATO Networks security policies, based on logs in CommonSecurityLog. It allows for filtering by specific devices or target URLs.
This rule identifies and aggregates blocked requests from Imperva WAF logs, grouping them by source IP address and then by the owning organization (ASN). It helps to detect and analyze potential attack campaigns or coordinated malicious activity originating from specific organizations or IP ranges. The rule focuses on security, session, and visitor blocks, providing details on attack names, query strings, referrers, and URLs.
Detects MongoDB instances with a vulnerable configuration where 'zlib' is enabled for network message compression. This configuration makes the server vulnerable to MongoBleed (CVE-2025-14847).
Detects multiple large POST requests to Next.js or React Server Component (RSC) endpoints from the same source IP. This pattern can indicate attempts to exploit unsafe deserialization vulnerabilities like React2Shell (CVE-2025-55182) by sending a crafted, oversized payload.
Detects the PeerBlight Linux backdoor masquerading as the '[ksoftirqd]' kernel thread. This is a defense evasion technique used by the malware to blend in with legitimate system processes.
Detects emails containing URLs with patterns characteristic of the Tycoon 2FA phishing kit. These URLs often contain a base64-encoded email address in the path, preceded by a special character.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This correlation rule identifies multiple risk events associated with the "Living Off The Land" analytic story. It aggregates and correlates events tagged under this story, focusing on systems with a high count of distinct sources (5 or more). The rule aims to detect suspicious behavior involving the use of legitimate tools for malicious purposes, which could lead to code execution, privilege escalation, or persistence within an environment.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. It leverages AWS CloudTrail logs to identify the `CreateTask` event from the DataSync service. This activity is significant because attackers can misuse DataSync to transfer sensitive data from a private AWS location to a public one, leading to data compromise. If confirmed malicious, this could result in unauthorized access to sensitive information, causing severe data breaches and compliance violations.
The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
The following analytic detects attempts to change the default file association for files without an extension to open with Notepad.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns and registry modifications. This activity is significant as it can indicate an attempt to manipulate file handling behavior, a technique observed in APT and ransomware attacks like Prestige. If confirmed malicious, this could allow attackers to execute arbitrary code by tricking users into opening files, potentially leading to system compromise or data exfiltration.
The following analytic identifies the execution of RAR utilities to archive files on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line arguments. This activity is significant as threat actors, including red-teamers and malware like DarkGate, use RAR archiving to compress and exfiltrate collected data from compromised hosts. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive information to command and control servers, posing a severe risk to data confidentiality and integrity.
Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure.
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
Page 17 of 23