Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,770
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects two scenarios on Linux systems: 1. A non-root process interacting with a root process (e.g., cross-process communication where the source is non-root and the target is root). 2. Any process (excluding root) exhibiting indicators related to 'AF_ALG' or 'splice', or mentioning 'CVE-2026-31431' in its name or description. These indicators are often associated with privilege escalation attempts or kernel exploits.
Detects exploitation attempts against GeoServer targeting CVE-2024-36401, a vulnerability involving unsafe OGC filter property name evaluation. The rule monitors for malicious HTTP patterns in incoming requests to OGC endpoints (ows, wfs, wms, wcs) and identifies subsequent suspicious process spawning by the GeoServer JVM instance that indicate successful remote code execution.
Detects endpoint browser and email client processes initiating network connections to domains and IP addresses associated with HolaBrief and LoopedIn open-redirect infrastructure, commonly leveraged in invoice-themed phishing campaigns.
This rule detects outbound network connections to the specific IP address 38.60.253.35 on port 8084. Such traffic is highly suspicious and indicative of potential communication with a Command and Control (C2) server.
Detects PHP processes reading both /proc/self/maps and /proc/self/mem within a short time window. This activity is indicative of an Address Space Layout Randomization (ASLR) bypass technique, specifically associated with exploits attempting to compute memory offsets for sensitive functions (e.g., zend_execute_internal, zif_system) to facilitate Remote Code Execution (RCE).
This rule detects network connections or DNS requests to the domain 'mitarchive.info', which is associated with known malicious activity. Monitoring for traffic to this domain can help identify hosts that may be compromised or attempting to communicate with an attacker-controlled infrastructure.
Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
This rule detects the exploitation of CVE-2026-20245 on Cisco SD-WAN Manager (vManage). It monitors for two distinct phases: 1) The suspicious upload of a tenant-list CSV file via CLI using a malicious filename, and 2) A subsequent privilege escalation attempt where the 'admin' user executes 'su' to switch to a 'troot' user, which is indicative of a backdoor account creation following successful exploitation.
Detects unauthorized persistence mechanisms on Cisco SD-WAN Manager, vSmart, and vBond nodes by monitoring for local account creation (e.g., useradd), modification of sensitive authentication files (/etc/passwd, /etc/shadow), and illicit SSH key placement in authorized_keys. This rule specifically monitors for known exploit paths involving the 'troot' account and related command-line activity indicative of unauthorized administrative access.
Detects LampoRAT malware based on known file hash execution.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This rule detects attempts to authenticate to SSH using GSSAPI (Generic Security Service Application Programming Interface). While GSSAPI can be used for legitimate authentication, its presence in logs might indicate an attacker attempting to use alternative authentication methods, potentially for lateral movement or privilege escalation, especially if unexpected in the environment.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
Detects Log4Shell JNDI exploitation attempts by scanning incoming network request data for JNDI patterns and simultaneously monitors for suspicious shell child processes (cmd, powershell, bash, sh) spawned by java.exe, indicating post-exploitation activity.
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
Detects unauthenticated Engine.IO WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. These requests, characterized by specific URI query parameters, are often used as an initial phase for exploitation against vulnerable instances of the application.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
Detects Node.js processes being executed with specific require flags or environment variables, while having parent processes or command-line arguments indicative of Flowise integration. This behavior is often associated with the execution of custom MCP (Model Context Protocol) tools or extensions within a Flowise workflow, which could potentially be abused for unauthorized operations or persistence.
Page 180 of 341