Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects instances where common web server processes (e.g., httpd, nginx) or system utility services (e.g., sshd, crond, dropbear) spawn shell processes like bash, sh, or ash. This activity is a classic indicator of potential remote command execution (RCE) via web application exploits or the abuse of legitimate system services to run arbitrary commands.
Detects network connections from common web browser processes (Chrome, Edge, Brave, Electron) to loopback addresses (127.0.0.1 or Localhost) where the URL path contains sensitive keywords like /code, /textbox, /credentials, or /secrets. This behavior is often associated with browser-based exploitation attempts, such as targeting local development servers or internal browser automation interfaces to extract sensitive information.
Hunting rule for Linux procfs heap credential harvesting: resolve a target PID
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
Hunting rule loosely modeled after Atomic Red Team T1048.002 test "Exfiltrate data in a file over HTTPS using wget". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for Linux procfs heap credential harvesting: resolve a target PID
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
Detects Linux processes masquerading as common daemons (smbd, httpd, sshd, crond) that are executing from non-standard file paths and establishing network connections on non-canonical ports to private (RFC1918) IP addresses. This behavior is indicative of a SOCKS5 proxy or C2 infrastructure masquerading as system services to blend in with legitimate traffic, as observed in Velvet Ant operations.
Detects malicious shell script execution on Linux edge/IoT devices associated with the JDY botnet exploitation of CVE-2026-35616. The rule identifies processes checking for MIPS-based architectures, using download utilities (wget, curl) for payload retrieval, and subsequent file deletion activity indicative of post-exploitation cleanup.
Detects network connections from common web browser processes (Chrome, Edge, Brave, Electron) to loopback addresses (127.0.0.1 or Localhost) where the URL path contains sensitive keywords like /code, /textbox, /credentials, or /secrets. This behavior is often associated with browser-based exploitation attempts, such as targeting local development servers or internal browser automation interfaces to extract sensitive information.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Detects web application processes (such as nginx, gunicorn, uvicorn, python, node, or java) attempting to read sensitive information from /proc/self, specifically /proc/self/environ, /proc/self/cmdline, or /proc/self/maps. This behavior is indicative of a Local File Read (LFR) vulnerability exploitation, which an attacker may use to exfiltrate environment variables containing secrets or Cloud Run service account credentials.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects the use of npm to install known malicious npm packages, which is indicative of a supply chain compromise attempt via typosquatting or malicious dependency injection.
Detects malicious browser extensions associated with the StegoAd campaign fetching steganographic payloads (WebP/PNG) from known C2 infrastructure. The detection identifies requests originating from a browser extension context (via Referer header) that target specific image files commonly used by the malware for post-compromise staging and execution guardrail fingerprinting.
Detects the upload and execution of a specific malicious CSV file (evil_tenant.csv) on Cisco SD-WAN Manager (vManage) systems. This file is associated with exploitation of CVE-2026-20245, enabling attackers to inject a persistent root backdoor account into the system files.
Detects the execution of common system enumeration commands (process listing, network configuration, and system information) on Cisco SD-WAN infrastructure nodes. This activity is indicative of post-exploitation reconnaissance used by attackers to understand the system environment, network topology, and identify potential pivot points within the SD-WAN infrastructure.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects various techniques used by an attacker to escape a container environment or gain unauthorized access to host-level resources. This includes the execution of namespace manipulation tools (nsenter, unshare, chroot), unauthorized access to the docker.sock Unix socket, mounting of host filesystems from within a container, and direct attempts to access the host's /proc/1 namespace files.
Detects the execution and network activity of known reverse tunneling and proxy tools such as Chisel, Ngrok, and FRP. These tools are commonly abused by adversaries to establish persistence, bypass firewalls, and facilitate command and control (C2) communication. The rule monitors for specific process names, command-line arguments, and DNS requests related to these services.
Page 183 of 347