Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects unauthorized writes to the /proc/sys/vm/drop_caches interface by non-root users or processes that are not standard system maintenance tools. This activity is a known post-exploitation technique used by exploits like the 'pedit' COW exploit to clear cached setuid binary pages in memory for evasion or cleanup.
Detects suspicious execution of kernel-related networking commands ('unshare', 'ip', 'modprobe', 'insmod') by non-root users that are associated with the setup or exploitation phases of the 'DirtyClone' Linux kernel privilege escalation exploit. The rule specifically looks for IPsec tunnel/policy manipulation or the loading of ESP/RxRPC kernel modules by unprivileged accounts.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
LockBit C2Beacon
YARA
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Cloud extortion group exploiting exposed credentials and storage
Cloud extortion group exploiting exposed credentials and storage
Fraud framework powering scam domains for crypto and gambling schemes
Loader malware delivering follow-on ransomware payloads
Ransomware group exploiting edge devices and managed file transfer software
Detects instances where package managers like npm, pip, or python execute shells or scripting interpreters with command-line arguments indicative of software installation or build processes. This pattern is common in supply chain attacks where malicious packages run code during their installation phase.
Detects unauthorized modifications to FreeBSD init scripts located in /etc/rc.d/, /usr/local/etc/rc.d/, or /etc/rc.subr. These directories are used for system service startup. The rule specifically monitors for modifications related to the BRICKSTORM persistence mechanism, which targets these scripts to execute malicious binaries such as /usr/local/libexec/ipsec/blacklist.
This rule detects potentially malicious activity related to the cron utility, including the modification of cron-related configuration files and the execution of specific suspicious payloads (e.g., ssync.sh, blacklist). It monitors for file creation, modification, or renaming events within sensitive directories, as well as the spawning of processes by cron daemons using identified suspicious paths or command names.
Detects anomalous process execution patterns indicative of privilege escalation or persistence on Linux systems. Specifically monitors for unexpected root shell access from non-privileged service accounts (e.g., www-data, apache), abuse of sudo for modifying privileged system files via tee, and execution of binaries from world-writable directories such as /tmp or /dev/shm, which is a common behavior during exploit staging.
Detects the presence of files known to be associated with malicious activity by matching their SHA256 hashes against a list of known bad indicators.
Detects network activity initiated by qemu-system-x86_64.exe to internal subnets using common lateral movement ports (21, 88, 389, 445, 636) or the execution of known tools netbird.exe or cookie_exporter.exe. This rule flags potential virtualization-based lateral movement or unauthorized tool usage.
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
This rule detects instances where npm or node.js processes are used to execute or spawn setup-related binaries or specific GitHub precheck scripts. This behavior is often associated with software deployment, CI/CD pipelines, or potentially malicious automation within development environments.
Detects network connection activity originating from QEMU virtualization processes (qemu-system-x86_64, qemu-system-i386, qemu-system-aarch64) to external (non-private/non-local) IP ranges. This could indicate the use of virtualization tools to facilitate tunneling, proxying, or lateral movement within an environment.
Page 190 of 347