Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects attempts to exploit the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for keywords related to FTP default configuration exploitation, specifically 'Safe_ports', 'CONNECT', 'PORT', 'PASV', '21', and 'tcp_outgoing_address'. This indicates an adversary trying to bypass security controls or exfiltrate data via FTP.
Detects the exploit chain for CVE-2026-43503, an unprivileged kernel exploitation vulnerability. The rule identifies the creation of user and network namespaces by non-root users, followed by the manipulation of XFRM states or policies, and the subsequent loading of ESP kernel modules, which together facilitate privilege escalation.
This rule detects post-execution activity associated with the lambsys/isp.sh cryptominer campaign. It triggers when a known miner binary (lambsys, procq, or isp.sh) is executed, followed within 3 minutes by suspicious cleanup operations including the deletion of log files (wtmp, btmp, system logs), staging directories, or tampering with command history files and shell environment variables.
This rule detects suspicious manipulation of Linux namespaces using the 'unshare' utility or manual modification of user ID mapping files ('uid_map', 'gid_map', 'setgroups') in '/proc/self/'. Such activities are characteristic of container escape attempts or privilege escalation, where an attacker seeks to gain root access on the host or map unprivileged users to privileged IDs within a new namespace.
This rule monitors network traffic for DNS queries directed at domains associated with known malicious browser extensions, specifically targeting Adblock for YouTube and Adblock for Chrome malicious variants. It correlates these connections with process command line evidence that matches the extension IDs of these malicious components.
Detects command-line execution of 'rm' or 'cp -a' targeting specific sensitive system, credential, or configuration files on Linux systems. This behavior often indicates an attempt to remove evidence, destroy logs, or stage sensitive data for exfiltration.
Detects execution of sensitive administrative binaries (rm, chmod, chown) targeting critical system files or directories, or direct interaction with sensitive system files and configuration logs which may indicate unauthorized data access or evidence tampering.
This rule detects successful SSH login events utilizing public key authentication for the 'vmanage-admin' user. It aggregates login events by source IP, username, and host to identify patterns of access for this specific administrative account.
Detects indicators of exploitation related to CVE-2026-20245 on Cisco Catalyst SD-WAN controllers, including malicious tenant CSV uploads, unauthorized account creation (troot), privilege escalation via su, anti-forensic backup of system configuration files, and configuration changes such as PermitRootLogin enabled.
This rule detects potentially malicious activities on Linux systems involving the creation of new accounts or access to sensitive files like /etc/passwd and /etc/shadow using or referencing the string 'troot'. This pattern is often associated with adversary attempts to create backdoored accounts or perform offline password cracking by manipulating or dumping authentication files.
Detects unauthorized access to sensitive credential and configuration files associated with AI development tools (Cursor, Claude, Gemini) and cloud providers (AWS, GCP) by the Miasma worm, which seeks to steal environment configuration and authentication data.
Detects suspicious user account creation activity or direct modification of the /etc/passwd file. The rule flags the use of 'useradd' or 'adduser' commands, as well as unauthorized attempts to inject root users into the passwd file, specifically looking for indicators like 'troot' (a common misconfiguration or backdoor username pattern).
Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.
Detects anomalous credential exfiltration attempts by GitHub Actions runners. The rule monitors for runner child processes (printenv, env, set) attempting to access sensitive CI/CD variables, or networking tools (curl, wget) transmitting data to unauthorized external endpoints, consistent with Miasma worm behavior.
This rule monitors for network connections from common developer-related processes (e.g., node, python, npm) to known blockchain RPC endpoints, followed by a subsequent network connection within 5 minutes that is not directed at those RPC endpoints or common developer infrastructure (e.g., GitHub, NPM, PyPI). This pattern is often indicative of potential malicious activity, such as a compromised development environment performing beaconing or staging data after interacting with blockchain services.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
This rule detects network activity associated with the StealC information stealer, specifically focusing on HTTP POST requests made to known command-and-control (C2) domains. It identifies characteristic URL patterns, such as randomly generated 16-character PHP files or specific index.php structures, which are used for bot registration and communication. The detection includes patterns indicative of RC4-encrypted payloads and behavior mimicking Amadey bot status checks.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects potential exploitation of CVE-2026-8461 (PixelSmash) where an attacker hijacks the AVBuffer.free function pointer in media processing software (ffmpeg, ffprobe, etc.) to trigger arbitrary code execution via a spawned shell process.
Page 208 of 341