Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects execution artifacts and prerequisite activities associated with the DirtyClone (CVE-2026-43503) local privilege escalation exploit. This includes monitoring for the creation of unprivileged user namespaces, loading specific kernel modules (esp4, esp6, rxrpc) often used in such exploits, compilation of associated exploit source files, and direct interaction with /proc/self/mem to perform memory-based exploitation.
This rule detects the creation of directories or files within /var/tmp that use the hidden naming convention (dot-prefix), specifically looking for '.xlamb' or '.x'. Such hidden directories in temporary storage locations are commonly used by attackers for staging malicious tools, malware, or backdoors.
Detects download, execution, and network activity associated with the 'isp.sh' dropper script. This includes the use of common utilities like curl or wget to fetch the script from a specific C2 IP address (83.142.209.214), piping the script directly to a shell, and signs of secondary payload execution such as 'lambsys'.
This rule detects network connections or DNS queries to known public tunneling services (e.g., Cloudflare Tunnel, localtunnel, bore, devtunnels) made by processes other than common web browsers. Attackers frequently use these services to bypass firewalls and establish unauthorized reverse shells or persistent C2 channels.
Detects attempts to disable or modify critical Linux security subsystems including SELinux and AppArmor. The rule monitors for the execution of commands such as setenforce, aa-teardown, and systemctl, or direct modifications to security configuration files.
Correlates a user passing a CAPTCHA gate (Cloudflare Turnstile, reCAPTCHA) with an immediate subsequent connection to an unknown, low-prevalence domain hosting the actual phishing landing page.
Detects the use of the AWS CLI to extract Secrets Manager values and potentially STS tokens, writing them to local text files in the /tmp directory. This activity is indicative of an attacker attempting to exfiltrate credentials or sensitive information.
Detects unauthorized modification or dropping of model files directly into the local Hugging Face cache directory (~/.cache/huggingface/hub) by non-standard development processes, indicating an attempt to swap legitimate models for backdoored ones.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
Detects command lines consistent with ArachneC2 implant generation and hardening options.
Detects creation of ArachneC2 operator key files under the default ~/.arachne directory.
This rule detects pre-payload beaconing activity associated with the Meow RAT malware. It covers both network-based detection (outbound HTTP POST to known C2 domains and paths) and endpoint-based detection. Endpoint detection includes 'curl' processes communicating with known C2 infrastructure, 'osascript' processes spawned in the context of 'curl' C2 communication, and 'curl' commands using specific flags ('-k', '-s') along with a known build hash. This activity typically occurs before the main destructive payload is delivered.
Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.
Detects processes exhibiting behaviors indicative of process injection, such as suspicious binary names, command-line arguments related to spawning sleep processes, or ptrace system calls. This rule identifies potential attempts to inject malicious code into other processes to evade defenses or elevate privileges.
Detects the execution of ffmpeg with the '-decoders' flag to enumerate available decoders, specifically looking for the vulnerable MagicYUV decoder. It also identifies 'grep' commands searching for 'magicyuv' in process command lines, which could indicate reconnaissance or triage activity related to CVE-2026-8461.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Identifies the Python script explicitly reading developer secrets including AWS credentials, SSH private keys, and Kubernetes configuration files.
Detects the execution of SSH or Plink processes with command-line arguments indicating local, remote, or dynamic port forwarding. Adversaries may use port forwarding to tunnel traffic through a compromised host to bypass network segment restrictions or access internal resources.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Detects Jellyfin or Emby media server processes (or their ffprobe/ffmpeg child workers) spawning anomalous shell processes such as /bin/sh or bash, consistent with exploitation of CVE-2026-8461 - a heap OOB write in the FFmpeg MagicYUV decoder that hijacks AVBuffer.free to call system() and fork a shell as the jellyfin service user (uid=115) or www-data.
Page 212 of 341