Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects the execution of bash or shell commands associated with a hidden directory '.task' and a specific script 'tokenlinux.sh'. This pattern is indicative of potential persistence mechanisms, unauthorized script execution, or command-and-control (C2) activity in a Linux environment.
Detects the execution of bash or shell commands associated with a hidden directory '.task' and a specific script 'tokenlinux.sh'. This pattern is indicative of potential persistence mechanisms, unauthorized script execution, or command-and-control (C2) activity in a Linux environment.
This rule detects the creation, modification, or renaming of a file named '/tmp/helper' within a one-day window of a 'curl' or 'wget' command-line execution that references this specific path. This pattern is commonly indicative of an adversary downloading and staging malicious tools or payloads in a temporary directory on Linux systems.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects the presence of known StyleSmuggler implant binaries (noted as Rust-based implants masquerading as gvfsd-user or kworker) by matching file SHA256 hashes.
Detects the presence of the StyleSmuggler Rust-based Linux implant. The rule identifies the malicious binary by its static SHA256 hashes or a combination of indicators including masquerading as a kernel thread, utilization of gvfsd-related filenames and directories, and interaction with Redis session data.
This rule detects common command-line utilities (cat, bash, sh, python, grep) being used to access the '/proc/1/environ' file. This file contains environment variables for the PID 1 process (typically the init system), which may include sensitive information such as credentials, configuration paths, or system secrets.
This rule detects high-frequency account and email address enumeration attempts. It monitors syslog data for SMTP commands such as VRFY, EXPN, or RCPT TO, and analyzes Microsoft Entra ID (SigninLogs) for authentication failures specifically associated with error code 50034 (user not found). Both behaviors are indicative of an adversary attempting to validate user identities within an environment, often as a precursor to targeted phishing or brute-force attacks.
Detects the use of common Linux command-line utilities (sed, grep, awk, bash, sh) to perform operations on sensitive system logs or shell history files. The rule targets command strings indicative of log modification, filtering, or removal of audit trails, often associated with an attacker attempting to conceal malicious activity.
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.
Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution.
Detects suspicious sub processes of web server processes
Detects a Ray raylet, gcs_server, or dashboard process spawning a calculator process (a near-certain PoC/exploit indicator) or a shell child process carrying suspicious network, encoding, or reverse-shell command-line indicators, consistent with post-exploitation of CVE-2025-62593. Known-legitimate pipeline package-install commands are filtered out to reduce noise from normal Ray job workers.
The following analytic detects when the AF_ALG kernel crypto socket interface being loaded more than 300 seconds after system boot, which is a primary kernel-level indicator of Copy Fail (CVE-2026-31431) exploitation activity on Debian and Ubuntu family systems.
The AF_ALG interface is required by the exploit to access the vulnerable authencesn crypto code path, and on systems where it is not auto-loaded at boot, its on-demand registration by an unprivileged process is a strong indicator of exploitation in progress.
The AF_ALG interface is required by the exploit to access the vulnerable authencesn crypto code path, and on systems where it is not auto-loaded at boot, its on-demand registration by an unprivileged process is a strong indicator of exploitation in progress.
The following analytic detects when su runs from a page-cache-corrupted binary.
When this happens a partial corruption of its runtime state can prevent it from resolving the identity of the calling user.
Under normal conditions, su logs both the target account and the invoking user.
When exploitation has occurred via this path, the invoking username field is absent.
This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access.
If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
When this happens a partial corruption of its runtime state can prevent it from resolving the identity of the calling user.
Under normal conditions, su logs both the target account and the invoking user.
When exploitation has occurred via this path, the invoking username field is absent.
This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access.
If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
Detects a suspicious sequence of commands within GitHub Actions runner environments where 'printf' is piped into 'base64 -w0'. This pattern is commonly used by attackers to encode CI/CD secrets before exfiltrating them via network requests, specifically to bypass plaintext string matching and simple keyword-based detection.
Detects successful SSH authentication to a Linux system using public-key authentication by monitoring system logs for the 'Accepted publickey for' message. This rule identifies remote access attempts and serves as a foundation for monitoring lateral movement via SSH.
Detects the creation and enablement of a systemd unit file that uses a deceptive description ('Apache HTTPD Cache Manager') and the 'Restart=always' directive. This pattern is characteristic of persistence mechanisms used by the Evooo1Bot malware, which attempts to maintain continuous execution by running as a system service.
Page 22 of 51