Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects evidence of the MYRA Linux RAT, which uses LD_PRELOAD hijacking via a malicious library located at /usr/local/lib/.libcache.so for persistence or execution flow hijacking. The rule also identifies the malware's practice of masquerading as the 'systemd-userdbd' service, often launched from a Node.js-based environment.
Detects outbound network connections to specific cloud storage providers (Wasabi, Tebi, I3Storage) which are commonly leveraged by adversaries for data exfiltration.
Detects network traffic to Cloudflare-hosted services (trycloudflare.com, workers.dev) potentially indicative of C2 communication, especially when initiated by common scripting or proxy processes like powershell.exe, wscript.exe, cscript.exe, mshta.exe, or cloudflared.exe.
Detects execution patterns associated with the DirtyClone (CVE-2026-43503) exploit, which involves an unprivileged process utilizing user and network namespaces to configure IPsec XFRM Security Associations (SAs) to corrupt the kernel page cache of sensitive binaries such as /usr/bin/su.
Detects a suspicious execution chain where 'node-gyp' is observed spawning 'node' to execute 'index.js', characteristic of a 'Phantom Gyp' malicious pattern, followed immediately by the execution of a temporary JavaScript payload via the 'bun' runtime. This pattern is indicative of a multi-stage loader often used in supply chain attacks involving obfuscated payloads.
Detects a sequence of events consistent with the DirtyClone/DirtyFrag kernel exploit: first, identifying precursor activities such as namespace manipulation (unshare), kernel module loading of networking components (esp4/6, rxrpc), or specific exploit binary execution; followed by an anomalous spawn of a root shell from an unprivileged parent process within a short 5-minute window.
This rule detects the execution of specific shell processes (sh, bash, crontab) where command-line arguments reference suspicious paths commonly associated with persistence mechanisms or malware, such as /var/tmp/ files or crontab spool directories.
This rule detects outbound network connections to common tunneling and proxy services (Cloudflare Tunnel, Cloudflare Workers, and Microsoft Dev Tunnels). These services are frequently abused by threat actors, such as the Gamaredon Group (ACTINIUM), to establish command-and-control (C2) channels and tunnel traffic to evade network-based detection systems.
Detects attempts to exploit the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for keywords related to FTP default configuration exploitation, specifically 'Safe_ports', 'CONNECT', 'PORT', 'PASV', '21', and 'tcp_outgoing_address'. This indicates an adversary trying to bypass security controls or exfiltrate data via FTP.
Detects the exploit chain for CVE-2026-43503, an unprivileged kernel exploitation vulnerability. The rule identifies the creation of user and network namespaces by non-root users, followed by the manipulation of XFRM states or policies, and the subsequent loading of ESP kernel modules, which together facilitate privilege escalation.
This rule detects post-execution activity associated with the lambsys/isp.sh cryptominer campaign. It triggers when a known miner binary (lambsys, procq, or isp.sh) is executed, followed within 3 minutes by suspicious cleanup operations including the deletion of log files (wtmp, btmp, system logs), staging directories, or tampering with command history files and shell environment variables.
This rule detects suspicious manipulation of Linux namespaces using the 'unshare' utility or manual modification of user ID mapping files ('uid_map', 'gid_map', 'setgroups') in '/proc/self/'. Such activities are characteristic of container escape attempts or privilege escalation, where an attacker seeks to gain root access on the host or map unprivileged users to privileged IDs within a new namespace.
This rule monitors network traffic for DNS queries directed at domains associated with known malicious browser extensions, specifically targeting Adblock for YouTube and Adblock for Chrome malicious variants. It correlates these connections with process command line evidence that matches the extension IDs of these malicious components.
Detects execution of sensitive administrative binaries (rm, chmod, chown) targeting critical system files or directories, or direct interaction with sensitive system files and configuration logs which may indicate unauthorized data access or evidence tampering.
This rule detects successful SSH login events utilizing public key authentication for the 'vmanage-admin' user. It aggregates login events by source IP, username, and host to identify patterns of access for this specific administrative account.
This rule detects network connections and DNS requests to specific domains associated with Unistream SDK and other known BadBlocker malware infrastructure, often linked to malicious browser extensions such as Adblock for YouTube and related variants.
This rule detects potentially malicious activities on Linux systems involving the creation of new accounts or access to sensitive files like /etc/passwd and /etc/shadow using or referencing the string 'troot'. This pattern is often associated with adversary attempts to create backdoored accounts or perform offline password cracking by manipulating or dumping authentication files.
Detects evidence of the MYRA Linux RAT executing payloads filelessly from memory using memfd_create and fexecve. The rule flags suspicious processes masquerading as systemd-userdbd, particularly when spawned from Node.js environments or associated with malicious packages like apintergrationpost or .libcache.so artifacts.
Detects suspicious user account creation activity or direct modification of the /etc/passwd file. The rule flags the use of 'useradd' or 'adduser' commands, as well as unauthorized attempts to inject root users into the passwd file, specifically looking for indicators like 'troot' (a common misconfiguration or backdoor username pattern).
Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.
Detects anomalous credential exfiltration attempts by GitHub Actions runners. The rule monitors for runner child processes (printenv, env, set) attempting to access sensitive CI/CD variables, or networking tools (curl, wget) transmitting data to unauthorized external endpoints, consistent with Miasma worm behavior.
Page 216 of 347