Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule monitors for network connections from common developer-related processes (e.g., node, python, npm) to known blockchain RPC endpoints, followed by a subsequent network connection within 5 minutes that is not directed at those RPC endpoints or common developer infrastructure (e.g., GitHub, NPM, PyPI). This pattern is often indicative of potential malicious activity, such as a compromised development environment performing beaconing or staging data after interacting with blockchain services.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects outbound network connections from workstations or servers to common message broker ports (MQTT 1883/8883, AMQP 5672). These protocols are sometimes abused for command-and-control (C2) communication, as they allow for pub/sub messaging patterns that can blend into legitimate network traffic.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects the use of the AWS CLI to extract Secrets Manager values and potentially STS tokens, writing them to local text files in the /tmp directory. This activity is indicative of an attacker attempting to exfiltrate credentials or sensitive information.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects MYRA RAT delivery via malicious npm package lifecycle scripts (e.g., postinstall) that trigger the compilation of native binaries such as libcache.so, memfd_loader, and others on Linux hosts.
Detects outbound network connections to a known malicious IP (83.142.209.214) associated with Lambsys cryptominer activity. The rule specifically monitors for HTTP POST requests to '/status.php' or '/setup_status.php' using the default 'Go-http-client/1.1' User-Agent, indicating a C2 beaconing pattern.
Detects high-volume credential stuffing attacks targeting the WordPress 'wp-login.php' endpoint. The rule monitors for multiple geographically distinct source IP addresses submitting HTTP POST requests to the login page within a 2-minute window. It specifically identifies traffic patterns associated with common infostealer-harvested credential campaigns (such as Vidar, Stealc, or DanaBot) by matching a specific User-Agent string associated with the campaign.
Detects processes using prctl with PR_SET_NAME to rename themselves to systemd-userdbd, a technique used by the MYRA RAT (Operation Friday Harvest) to masquerade as a legitimate system daemon and evade process-tree inspection. The rule looks for processes with 'systemd-userdbd' in their product name or in specific suspicious folders, or processes named 'systemd-userdbd' initiated by 'node' or 'npm'. It also identifies process name changes or modifications to process primary tokens that include 'systemd-userdbd'.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
This rule detects potential data exfiltration attempts by monitoring for network connections to URLs containing suspicious substrings (bit, onion, .cc, .su) over common web and DNS ports (53, 80, 443, 8080). It flags high-frequency unique connection attempts from a single device, which may indicate command-and-control (C2) traffic or data exfiltration over covert channels.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
Correlates the reading of sensitive local files (id_rsa, .env, config.json) followed by an immediate POST request to an LLM API (specifically api.openai.com), indicating data theft via prompt injection or automated analysis.
This rule detects suspicious activity involving Docker containers, specifically focusing on path traversal attempts via the 'docker cp' command, execution of potential proof-of-concept scripts, or the creation of specific marker files indicating attempts to interact with or escape from the containerized environment to the underlying host.
This rule detects activities associated with a specific malicious browser extension, including the presence of its files on disk, execution of browsers with the extension ID in the command line, and network connections to known malicious or typosquatted domains (perplexity-ai.online, extension.tilda.ws) used for C2 or exfiltration.
Detects DNS queries to known StegoAd command-and-control domains 'liveupdt.com' and 'dealctr.com'. These domains are used by the StegoAd campaign to deliver steganographic payloads and push malicious JavaScript to compromised browser extensions.
This rule detects suspicious command-line activity where shell interpreters (bash, sh, dash, python) are used to search for or interact with potentially sensitive system files, such as password files or custom indicators of compromise like 'evil_tenant'. The query targets grep, find, ls, and echo commands used to locate or confirm the existence of these sensitive artifacts.
Detects the execution of common Linux administrative, network, and system information gathering commands, often associated with reconnaissance activity by an adversary after gaining shell access.
Detects unauthorized modifications to SSH authorized_keys files and changes to SSH configuration (specifically PermitRootLogin) on Cisco SD-WAN controllers, which may indicate persistence or unauthorized remote access attempts.
Page 217 of 347