Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects network flows to RustDesk relay server ports (21115, 21116, 21117) characterized by anomalous connection patterns. The rule identifies hosts exhibiting rapid, repeated connection attempts or connections to multiple distinct relay IP addresses within a short timeframe. This behavior is consistent with the 'rustdesk-session-permission-pocs' technique, which may indicate an attacker attempting to establish a remote session while bypassing the standard permission handshake exchange required by the application.
Detects Node.js processes associated with NodeBB making outbound network connections to suspicious paths (/users/, /activities/, /inbox, /.well-known/webfinger). This activity may indicate exploitation of the NodeBB ActivityPub plugin (attributedTo UID spoofing), where an attacker forces the application to fetch attacker-controlled URIs.
Detects evidence of the NodeBB ActivityPub UID spoofing proof-of-concept (PoC) script (poc.js). The rule identifies the execution of node processes using specific command-line arguments (--target-base, --actor-origin, --spoof-uid, --recipient-uid) associated with the exploit, as well as Node.js processes making outbound network connections to ActivityPub path components (/inbox, /activitypub) over non-standard network ports. This activity is indicative of vulnerability testing or exploitation attempts.
Detects evidence of libssh2 publickey list heap corruption exploitation, including the presence or execution of known proof-of-concept (PoC) binaries, malicious SSH server connection patterns on port 2228, and suspicious child processes (e.g., cmd.exe, calc.exe) spawned by SSH clients or daemons.
Detects unauthorized modifications to SSH authorized_keys files and changes to SSH configuration (specifically PermitRootLogin) on Cisco SD-WAN controllers, which may indicate persistence or unauthorized remote access attempts.
Detects execution of objdump with DLX architecture flags, unauthorized child processes spawned by objdump, or the execution of known exploit proof-of-concept (PoC) artifacts associated with the 'objdump-dlx-calc-poc' vulnerability.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
Detects network connections to the Telegram API, specifically to the /sendMessage or /getUpdates endpoints. This activity can be indicative of command and control (C2) communication or data exfiltration using Telegram as a covert channel.
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Detects the Miasma worm utilizing the Bun runtime to execute malicious payloads. The detection looks for Bun processes executing scripts from /tmp/, specifically patterns associated with the Miasma worm, or processes matching the known malicious Bun runtime hash.
Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.
This rule detects various methods of establishing a reverse shell on Linux systems. It looks for process creation events involving common shell interpreters (bash, sh) attempting to connect to network devices via /dev/tcp or /dev/udp. It also identifies the use of network utilities like netcat (nc, ncat, netcat, nc.traditional) and socat when used with command execution flags (-e, -c, EXEC) and shell interpreters. Additionally, it flags direct outbound network connections initiated by these shell interpreters or network utilities, which could indicate a reverse shell communication channel.
Detects anomalous activity associated with Amazon Q processes, including unauthorized access to SSH agent binaries, attempts to read SSH configuration files or keys in ~/.ssh/, and suspicious outbound network connections over port 22, potentially indicating lateral movement.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects the use of AppArmor administrative and diagnostic tools (aa-exec, aa-status, apparmor_parser) with non-root accounts, or usage containing flags indicative of profile bypass attempts or privilege restriction probing.
Detects the creation or modification of '.amazonq.mcp.json' files associated with the Model Context Protocol (MCP) in VS Code or similar IDE environments, alongside the subsequent spawning of shell interpreters (bash, sh, cmd, powershell, python, npx) from these IDE processes. The rule further flags these events as 'HIGH' priority if the command line references sensitive patterns like AWS credentials or SSH/AWS paths, suggesting potential credential harvesting or unauthorized post-exploitation activity originating from the IDE environment.
Detects instances where the Amazon Q language server or VS Code extension host spawns suspicious child processes, such as shells, interpreters (python, bash, powershell), or utilities commonly used to query or extract AWS cloud credentials.
Detects attempts to modify or bypass AppArmor security profiles using utilities such as aa-complain, aa-disable, or apparmor_parser, correlated with process execution involving user namespace unsharing (e.g., via unshare or CLONE_NEWUSER/CLONE_NEWNET). This combination suggests an attacker attempting to weaken host security controls or perform a container breakout or privilege escalation by manipulating kernel-level namespaces and security policies.
This rule detects suspicious activity patterns on Linux systems that may indicate privilege escalation or container escape attempts. It monitors three main behaviors: the execution of network configuration tools (tc, insmod, modprobe) for kernel-level manipulations (pedit/actions), the use of 'unshare' to create isolated namespaces, and typical privilege escalation commands (su, id, whoami, bash) executed by non-root users. The rule correlates these events and alerts based on the combination and intensity of these behaviors, flagging high-severity activity when kernel-level tools are combined with namespace manipulation or privilege elevation.
This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.
Page 217 of 341