Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.
Detects suspicious execution patterns originating from or associated with crontab, crond, or anacron processes. The rule identifies potential persistence or malicious task scheduling by monitoring specific command-line indicators such as execution from /tmp or /dev/shm, unusual execution intervals, or specific shell command patterns associated with cron job abuse.
Detects instances where node.js or npm processes access multiple sensitive configuration or credential files (such as .aws/credentials, .npmrc, .pypirc, .gitconfig, or docker configs) and subsequently perform DNS queries against known malicious or suspicious C2 domains.
Detects Node.js processes accessing common shell history files (e.g., .bash_history, .zsh_history, PowerShell history). Such behavior is often indicative of credential harvesting or post-exploitation reconnaissance activity, specifically where a Node.js runtime environment is being leveraged to read sensitive user activity logs.
Detects multiple failed SSH login attempts from a single source IP address, indicating a potential brute force attack. The rule identifies 'Invalid user' or 'Failed password' messages in syslog from the 'sshd' process and groups them by source IP and time to count unique attempted users and total attempts. A threshold of more than 5 attempted users from a single source IP within a 10-minute window triggers an alert.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule detects the creation or modification of files that contain common certificate-related keywords such as 'crl', 'certificate', or 'pem'. This activity could indicate the deployment of new certificates, which might be legitimate or malicious, such as for establishing command and control, code signing, or evading detection.
Detects outbound network connections to the domain 'financemachinelearning.com' from any host. This domain may be associated with suspicious activity or command and control infrastructure.
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
Detects the modification or creation of Pluggable Authentication Module (PAM) files or shared libraries in Linux environments. This technique is often used to establish persistence or intercept authentication credentials by replacing legitimate modules like pam_unix.so with malicious counterparts.
Detects the 'Operation Highland' technique where an attacker-controlled binary named 'uptime' is executed by the 'fcgiwrap' process. This configuration acts as a FastCGI bridge, which subsequently spawns 'ssh' to establish unauthorized network connections into isolated network segments based on parameters received via HTTP POST requests.
Detects successful authentication for a user account immediately following a password change event. This pattern is indicative of a compromised PAM (Pluggable Authentication Modules) component or similar authentication backdoor that utilizes a hardcoded 'master' password to maintain access, bypassing credential rotation. This behavior is associated with the threat actor Velvet Ant (Operation Highland).
Detects execution of GS-Netcat covert C2 tunnels or masqueraded 'uptime' binaries running from non-standard system paths, consistent with persistent implants used by the Velvet Ant threat actor in Operation Highland.
Detects an internet-facing host in the DMZ that receives an inbound connection from an external non-RFC1918 address and subsequently authenticates to an internal RFC1918 host within a one-hour window. This behavior is indicative of a compromised DMZ host being used as a pivot point for lateral movement into the internal network.
This rule detects Server-Side Request Forgery (SSRF) attempts by monitoring for URL parameters containing malicious path injections. Specifically, it looks for sequences typical of differential parsing vulnerabilities where an attacker attempts to access sensitive local files (e.g., /proc/self/environ, /var/task/) or internal cloud metadata services (metadata.google.internal) by manipulating a 'url' parameter, often combined with attempts to bypass path validation using double-slash formatting.
Detects Server-Side Request Forgery (SSRF) attempts targeting cloud provider metadata services (specifically GCP) or sensitive local files like '/proc/self/environ' using common bypass patterns and request structures. These requests typically originate from an application process attempting to access internal environment variables or cloud identity metadata.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
This rule detects potentially suspicious modifications to Nginx configuration files or the usage of FastCGI directives such as fcgiwrap, fastcgi_pass, and proxy_pass. It specifically monitors for actions related to configuration changes (write, modify, create) or the establishment of backend communication via FastCGI parameters, which may indicate an attempt to gain remote code execution or persistence on a web server.
Detects high-frequency network requests from a single process to potentially sensitive targets such as cloud metadata services (169.254.169.254, metadata.google.internal) or using URL traversal patterns (../, %2e%2e, %2f). This behavior is characteristic of Server-Side Request Forgery (SSRF) attempts, where an attacker tries to access internal resources by forcing an application to make unauthorized requests.
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
Page 182 of 347