Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,769
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects repeated SSH connection attempts to a server over a short duration (10+ attempts in 60 seconds), which is characteristic of credential stuffing or brute-force password guessing attacks against the SSH service.
Detects multiple TCP connection attempts to port 22 (SSH) from the same source within a 60-second window, which is indicative of a brute-force or password guessing attack against SSH services.
Detects multiple SSH authentication attempts from a single source IP address within a short timeframe, which is indicative of a brute force or password guessing attack against SSH services.
Detects multiple failed SSH authentication attempts originating from a single source IP within a short timeframe, which is indicative of a brute-force or credential-stuffing attack against SSH services.
This rule monitors for potential Server-Side Template Injection (SSTI) exploitation by detecting web application processes (such as Java, Python, or Web Server binaries) that initiate child processes (such as shell interpreters or script engines) while their command line contains common SSTI markers or exploitation patterns like '{{7*7}}', 'subprocess.Popen', or 'java.lang.Runtime'. This indicates an attacker has successfully escalated from template injection to remote code execution.
Detects outbound network connections (DNS queries or direct IP connections) to a set of known domains frequently associated with software cracking tools, unauthorized installers, or potentially unwanted programs (PUPs).
This rule detects the creation of files with naming conventions associated with common document-based phishing lures (e.g., invoices, fiscal documents) or DNS requests to specific domains (e.g., pages.dev) frequently leveraged by attackers for hosting malicious content.
Detects execution of specific shell commands (shell, kill, upload, stop) often associated with remote access trojans or backdoors. This rule monitors process creation events where these specific command verbs are present in the command line of either the process itself or its initiator, commonly seen in scenarios where a backdoor receives commands via system execution primitives like execvp() or posix_spawnp().
Detects the execution or network communication involving python-build-standalone, a tool often used by developers to deploy portable Python environments. In an environment, the unauthorized use of this tool may indicate an adversary attempting to deploy their own Python interpreter to execute malicious scripts, effectively bypassing environment-specific restrictions or configurations.
Detects outbound UDP traffic over port 3478 (STUN) initiated by common web browsers. This pattern is commonly used by phishing-as-a-service (PaaS) platforms like Bluekit to perform WebRTC IP leak checks, potentially revealing a victim's real IP address behind a proxy or VPN. The rule excludes common communication platforms like Microsoft Teams, Zoom, and Webex to reduce false positives.
Detects network communication with known malicious domains associated with fraudulent or malicious 'Adblock for YouTube' browser extensions, as well as suspicious process command lines related to main world script injection performed by these extensions.
This rule detects suspicious activity associated with the Bun runtime after an npm package install. It flags instances where Bun, or download utilities (curl/wget) fetching 'bun.sh', are spawned from Node.js-related processes (npm, node, node-gyp) particularly when located in common temporary or cache directories, indicating potential supply chain compromise or unauthorized runtime deployment during build processes.
Detects incoming HTTP POST requests directed at PHP, ASPX, or JSP files that contain suspicious command execution patterns (such as cmd=, exec=, system(, or eval()). This behavior is highly indicative of an attacker interacting with a web shell to execute unauthorized commands on the server.
Detects persistence mechanisms associated with the MYRA Linux RAT, including malicious library injection via LD_PRELOAD using /usr/local/lib/.libcache.so, creation of persistence scripts in /etc/profile.d/, and process masquerading where a process executes as 'systemd-userdbd' but is not launched by the legitimate systemd manager.
This rule detects the invocation of local AI/LLM CLI utilities (e.g., ollama, llama-cpp) by potentially malicious or automated parent processes. It specifically flags scenarios where non-interactive or scripting-based processes (such as WScript, PowerShell, or Python) attempt to use these AI tools, particularly when the command line includes keywords related to sensitive data discovery, such as 'password', 'token', or 'private key'. This behavior is characteristic of infostealer activity (e.g., QUIETVAULT) attempting to use AI tools for automated reconnaissance and credential extraction.
Detects a suspicious sequence of events where a non-root user executes the unshare utility to create a new user and network namespace, followed immediately by the execution of the tc (Traffic Control) utility with parameters (ingress, filter, pedit) indicative of network traffic manipulation or potential exploit exploitation within the created namespace.
Detects the use of legitimate command-line utilities such as rclone, AWS CLI, AzCopy, curl, and wget to upload data to cloud storage endpoints, which is a common technique used for data exfiltration.
This rule detects multi-stage attack patterns indicative of Linux privilege escalation or exploit staging. It tracks the creation of known exploit-related files in temporary directories, the compilation of exploit source code, downloading of scripts from GitHub to temporary directories, and the execution of binaries or commands (e.g., 'unshare', 'tc') often associated with kernel-level exploits. It flags hosts where multiple such indicators are detected sequentially within a single session.
Detects unprivileged processes creating a new user namespace (CLONE_NEWUSER) followed by a network namespace (CLONE_NEWNET) and modifying procfs mapping files (uid_map, gid_map). This sequence is characteristic of the exploitation staging phase for CVE-2026-43503 (DirtyClone) to gain CAP_NET_ADMIN privileges and overwrite the page cache.
Detects evidence of log deletion, logrotate configuration modification, or syslog daemon termination (rsyslog, syslog-ng, journald) occurring within 30 minutes of suspicious child process activity from common web application interpreters (e.g., python, node, java, php). This correlation pattern is a strong indicator of post-exploitation activity aimed at clearing tracks or impairing host logging services.
Detects a suspicious sequence of events on Linux where a non-root process creates a user namespace followed within 5 minutes by either network XFRM policy manipulation or the loading of specific kernel modules (esp4, esp6, or rxrpc). This behavior is characteristic of an attempt to bypass kernel security restrictions or establish unauthorized encrypted tunnels.
Page 186 of 341