Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.
Detects instances where scripting processes (Python, Node.js) accessed SSH key files or configuration files and subsequently initiated an outbound network connection within 60 seconds, which may indicate potential exfiltration of credentials or unauthorized access.
Detects suspicious executions of Python interpreters or Pip package managers originating from common development tools (like VS Code or Node.js) or utilizing temporary file paths. The rule also monitors for suspicious command-line arguments that indicate obfuscation, encoded payloads, or the use of dynamic evaluation functions.
Detects creation of systemd service unit files for Linux persistence
This rule detects the creation of user namespaces on Linux systems by unprivileged users. The 'unshare' command with '--user' or '-U' flags allows a process to move into a new user namespace, which can be abused for privilege escalation or container escape. The rule specifically excludes common container runtimes and processes running as 'root' to reduce false positives.
Detects modification of shell profile files for command execution on login
Detects use of Linux extended attributes to hide malicious data
This rule detects the creation or modification of specific script files in common Linux persistence locations: '/etc/profile.d/' or '/usr/local/lib/'. Adversaries may modify or create scripts like '.sh.local' or '.cache-update.sh' in these directories to establish persistence, as these scripts can be executed automatically during system boot or user login.
Detects processes exhibiting behaviors indicative of process injection, such as suspicious binary names, command-line arguments related to spawning sleep processes, or ptrace system calls. This rule identifies potential attempts to inject malicious code into other processes to evade defenses or elevate privileges.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects when a known OpenClaw AI agent process spawns a shell to download and immediately execute a script. This is a common pattern used by malicious "Skills" to establish persistence or run further payloads, as detailed in the NSFOCUS report.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Detects the execution of 'opsec_enum.sh', a post-exploitation cleanup script, and associated activity involving ZipSlip-based webshell persistence components (such as 'mkzip34.py' and specific chunked file names) used by the threat actor MexicanMafia during Operation Escaneo.
Detects the creation of files on web servers matching known Neo-reGeorg web shell tunnel variants. These files are typically used as backdoors to tunnel traffic and provide persistent access to the server.
This rule detects the execution of scripts and commands associated with known SAP RFC exploitation attempts, including specific shell scripts used for RCE or credential extraction, as well as the invocation of SAP function modules like SXPG_CALL_SYSTEM for OS command execution. These patterns are consistent with post-exploitation activity or unauthorized system administration in SAP environments.
Detects the execution of known Oracle database PII exfiltration scripts and patterns associated with the 'MexicanMafia Operation Escaneo' campaign. The rule monitors for specific command-line activity, including the use of extraction scripts like 'dump_oracle_pii.sh', 'fast_extract.py', and database-level exfiltration techniques such as UTL_FILE or sys_eval targeting incremental CSV exports to /tmp.
This rule detects the use of the JSON-RPC 'eth_call' method by non-browser processes during network connection events. It specifically looks for network connections where the initiating process is not a common web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the 'eth_call' method. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the Check Point research.
Detects attempts to exploit the PwnKit vulnerability (CVE-2021-4034) in Polkit's pkexec. The rule monitors for malicious command-line arguments involving GCONV_PATH environment manipulation, the execution of pkexec by non-root users, and the presence of associated PwnKit payload artifacts, such as base64-encoded strings or specific chunked files.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the spawning of root shells from suid binaries (su) in conjunction with user namespace creation or suspicious parent process execution, potentially indicating exploitation of local privilege escalation vulnerabilities like the pedit COW page cache poisoning (CVE-2026-46331). The detection correlates non-root process activity in suspicious locations with subsequent elevated shell creation.
This rule detects suspicious activity patterns on Linux systems that may indicate privilege escalation or container escape attempts. It monitors three main behaviors: the execution of network configuration tools (tc, insmod, modprobe) for kernel-level manipulations (pedit/actions), the use of 'unshare' to create isolated namespaces, and typical privilege escalation commands (su, id, whoami, bash) executed by non-root users. The rule correlates these events and alerts based on the combination and intensity of these behaviors, flagging high-severity activity when kernel-level tools are combined with namespace manipulation or privilege elevation.
Page 215 of 347