Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects multiple failed SSH authentication attempts originating from a single source IP within a short timeframe, which is indicative of a brute-force or credential-stuffing attack against SSH services.
Detects multiple SSH authentication attempts from a single source IP address within a short timeframe, which is indicative of a brute force or password guessing attack against SSH services.
This rule detects potentially malicious modification of sensitive configuration files (e.g., /etc/ssh/sshd_config, /etc/passwd, /etc/shadow) or the execution of chmod/chown commands on sensitive files. It also flags common persistence/backdoor techniques such as modifying SSH settings to allow root login or applying dangerous permissions (777, setuid, setgid) to binaries, which could facilitate privilege escalation.
This rule detects HTTP requests attempting to perform Local File Inclusion (LFI) or path traversal attacks by searching for patterns such as '/../' sequences and common sensitive file paths like /etc/passwd, /etc/shadow, or /proc/self/environ in the URI.
Detects Visual Studio Code or Cursor IDE spawning a node.js process that executes a payload disguised as a .woff2 font file. This behavior is associated with supply chain attacks where malicious npm packages use hidden VS Code workspace tasks (e.g., folderOpen) to execute arbitrary code.
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.
Detects suspicious activity on Cisco SD-WAN infrastructure (vManage, vSmart, vBond) associated with unauthorized configuration changes, potential exploitation of CVE-2026-20245, rogue account creation, and anti-forensic behaviors.
Detects instances where a Python process is spawned by npm or node and subsequently attempts to access sensitive browser or cloud credential files. This pattern is characteristic of malicious npm packages used for credential theft.
This rule detects potentially suspicious activity related to VS Code extensions or development environments, specifically targeting the creation of 'tasks.json' files by Node.js processes, or the spawning of suspicious child processes (such as shells or interpreters) by VS Code-related processes with command lines associated with common malicious patterns or unauthorized automation.
Detects Node.js processes launched via command line with potentially obfuscated or malicious code patterns. This includes the use of eval-like flags combined with JavaScript memory management or network-related library imports, as well as command lines containing unusually long hex-encoded strings or base64-encoded blocks often used by attackers to hide payloads.
Detects HTTP POST requests containing multipart form data that include suspicious PHP functions commonly associated with webshells, such as eval(), base64_decode(), system(), or passthru(). This indicates a potential attempt to upload or execute a malicious PHP script on a web server.
Detects multiple TCP synchronization (SYN) packets targeting the SSH service (port 22) from a single source IP address within a short timeframe. This behavior is indicative of a brute-force or credential-guessing attack against the SSH service.
Detects repeated SSH connection attempts to a server over a short duration (10+ attempts in 60 seconds), which is characteristic of credential stuffing or brute-force password guessing attacks against the SSH service.
This rule detects two scenarios on Linux systems: 1. A non-root process interacting with a root process (e.g., cross-process communication where the source is non-root and the target is root). 2. Any process (excluding root) exhibiting indicators related to 'AF_ALG' or 'splice', or mentioning 'CVE-2026-31431' in its name or description. These indicators are often associated with privilege escalation attempts or kernel exploits.
Detects the post-exploitation pattern associated with the DirtyClone (CVE-2026-43503) vulnerability, where a non-root process executes '/usr/bin/su' with the '-c /bin/sh' argument, resulting in a spawned shell running with root privileges. This behavior is indicative of an in-memory patch to the su binary's page cache, allowing for unauthorized privilege escalation without modifying the on-disk binary or triggering standard PAM authentication events.
Identifies the execution of MeshCentral for remote command execution, specifically looking for 'meshctrl.js RunCommand' in process command lines or syslog messages. This activity has been associated with threat actors like ShinyHunters for staging payloads.
This rule monitors incoming TCP traffic on port 22 (SSH) and alerts when a single source IP address exhibits an excessive number of authentication attempts within a 60-second window, which is indicative of a brute-force attack against the SSH service.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
Detects potential dynamic linker hijacking on Linux systems by monitoring for the use of non-standard LD_PRELOAD paths in process command lines or unauthorized modifications to the /etc/ld.so.preload configuration file, which can be used to inject malicious code into processes.
Detects anomalous browser activity where an endpoint retrieves configuration or scriptlets from the BadBlocker-related API, followed shortly by outbound network connections to suspicious domains or the exfiltration of sensitive browser-based session data like document.cookie, localStorage, or sessionStorage.
Page 203 of 341