Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects unauthorized or suspicious processes accessing sensitive files within the Linux /proc filesystem or application-specific directories (such as graph_api.py, main.py, or requirements.txt). By excluding standard administrative tools like systemd, rpm, dpkg, and apt, this rule highlights processes that may be performing reconnaissance, credential harvesting, or attempting to read source code in an abnormal manner.
Detects two distinct suspicious activities on Linux systems: masquerading by processes named 'uptime' making outbound network connections to non-local IP ranges, and the execution of binaries associated with AtlasRAT.
Detects suspicious execution of 'ssh', 'sshd', or 'uptime' binaries initiated by web server processes like 'nginx', 'fcgiwrap', or 'uptime'. This behavior often indicates exploitation of a web application to gain remote access or execute unauthorized system commands.
This rule detects the execution of 'gs-netcat' or 'gsocket' utilities, as well as specific configurations of 'smbd' that suggest potential use of network tools for remote command and control or unauthorized access. GSocket allows for the creation of secure reverse shells and peer-to-peer communication channels, which are often used by adversaries to bypass firewall restrictions.
This rule detects successful SSH sessions initiated on Linux systems that are immediately followed by the creation of new executable or script files in common temporary directories such as /tmp, /dev/shm, or /var/tmp. This behavior is indicative of potential post-exploitation activity where an attacker drops tools or malicious scripts after gaining remote access.
This rule detects potentially malicious activity involving the Linux 'uptime' utility, including abnormal network connections to non-private IP addresses, execution with command-line flags often associated with non-standard utility behavior, and the creation of systemd service files, which may indicate a persistence mechanism.
Detects access to sensitive GCP credential-related files or the presence of credential-related environment variables/secrets in command lines and network request bodies. This pattern is often associated with the theft of service account keys or environment-based cloud credentials, frequently seen in serverless or containerized environments.
Detects instances where the SSH daemon (sshd) or its related components, such as PAM libraries, create or write to files located in /tmp/ or hidden files in /var/ directories, which may indicate unauthorized configuration changes, credential manipulation, or staging of malicious files.
This rule detects unauthorized or suspicious write operations to Linux Pluggable Authentication Modules (PAM) configuration files or shared libraries. PAM controls authentication for various system services; unauthorized modification of these files is a common technique used by attackers to establish backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common system package management utilities to reduce noise.
Detects the creation or modification of files within /etc/systemd/system/ or /etc/init.d/ by non-standard management processes. Attackers often use these paths to establish persistence by creating or altering service unit files to execute malicious code automatically upon system boot or service restart. The rule specifically excludes common system management tools.
Detects instances where a Perl interpreter attempts to mask itself as a Samba (smbd) service process, or where smbd/perl processes initiate network connections on port 5000, and identifies smbd processes spawned by non-standard parent processes like sh, bash, or perl, which is indicative of potential unauthorized service manipulation or backdoor activity.
Detects the execution of GSocket (gs-netcat), a network tool often used for establishing persistent backdoors, interactive shells, or SOCKS proxies. The rule identifies execution with common flags for daemonization, interactive shell access, or SOCKS proxying, as well as instances where the process masquerades as common system binaries (e.g., smbd, sshd) or is initiated from system persistence directories like systemd or init.d.
Detects instances where the sshd process or PAM-related processes create or write to files within temporary directories (/tmp/ or /var/). This behavior is often associated with the staging of malicious scripts, backdoors, or tools during an attack involving credential abuse or unauthorized access via SSH.
This rule detects two suspicious behaviors associated with OpenSSH components: the direct modification or replacement of critical OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp), or the use of these processes to write files to suspicious or non-standard locations (such as /tmp/ or unauthorized subdirectories within /var/log/), which may indicate credential harvesting or the presence of a backdoor.
Detects path traversal attempts within HTTP request parameters, specifically identifying encoded traversal sequences, file protocol usage, and attempts to access sensitive system files like /etc/passwd or /proc/self/environ.
This rule detects unauthorized write, modification, or creation events on critical SSH binary files (sshd, ssh, scp) on Linux systems. It excludes legitimate package management tools (e.g., apt, yum, dpkg, rpm) from triggering alerts to reduce noise from system updates.
Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.
Detects instances where common web application processes (such as Flask, Django, Gunicorn) execute system utilities (curl, wget, etc.) to query the cloud metadata service URL (169.254.169.254) or domain names associated with instance metadata. This behavior is indicative of potential SSRF exploitation to retrieve cloud environment secrets or instance identity credentials.
This rule detects potentially malicious or masqueraded Samba (smbd) activity on Linux systems. It monitors for three conditions: smbd processes launched from non-standard binary paths, smbd process network activity from non-standard binary paths, and smbd processes spawned by unauthorized or unexpected parent processes. These patterns are often associated with unauthorized SMB service deployment, malware persistence, or masquerading techniques.
Detects the use of Gsocket or gs-netcat utilities for outbound network connections on non-standard ports, as well as the execution of masqueraded 'uptime' binaries making network connections. It also monitors for DNS resolutions associated with Gsocket relay infrastructure to identify potential command and control or unauthorized tunneling attempts.
Detects signs of JDY botnet activity on Linux systems, specifically identifying shell-based payload downloads using curl or wget, or the execution of binaries directly from temporary directories, a pattern common in IoT firmware compromises.
Page 223 of 341