Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects developers cloning a repository (mimicking a coding interview test) and immediately executing an anomalous binary or script hidden within the project structure. This behavior is indicative of the Void Dokkaebi threat actor's tactics.
Identifies package managers (npm, pip) executing pre-install scripts that perform immediate system reconnaissance (whoami, hostname, sw_vers, systeminfo) characteristic of Void Dokkaebi payloads. This rule looks for a sequence where a package manager initiates a process, and that initiated process then launches a reconnaissance command.
Detects the decoded execution of bash/sh reverse shells initiated from processes like node.exe or python.exe, which is indicative of the Void Dokkaebi threat actor's tactics. The rule specifically looks for command lines containing 'echo' with base64 encoded strings, followed by 'base64 -d' and then 'sh' or 'bash' for execution.
Detects unauthorized execution of Oracle DBMS_SCHEDULER jobs combined with UTL_FILE output retrieval, a TTP observed in Operation Escaneo. The rule identifies suspicious command lines involving common database-layer exploitation scripts, manipulation of DBMS_SCHEDULER jobs, and interaction with the /tmp directory to exfiltrate or read command outputs.
Detects anomalous process execution patterns originating from SAP system processes or accounts, such as SAP work processes spawning shell commands, usage of known RCE-related scripts, and privileged accounts like WF-BATCH or TMSADM invoking administrative command-line tools.
Detects anomalous process execution patterns where a database process (postgres or postmaster) or a common system utility (nc, python, bash) is observed initiating unauthorized network connections to a known external C2 IP or accessing sensitive cryptographic files (e.g., server.key). This behavior is indicative of potential post-exploitation activity, specifically the exfiltration of credentials or sensitive data via database-level command execution (sys_eval) or direct file manipulation.
Sshpass Lateral Movement
YARA-L
Detects sshpass automation usage by administrative accounts
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Detects the execution of various reconnaissance tools and scripts identified as part of the Kimera framework, utilized by the threat actor group MexicanMafia in Operation Escaneo. This rule monitors for specific tool names (subfinder, assetfinder, gobuster, dnsx, naabu, httpx, gowitness, findomain), associated Python scripts, and specific command-line arguments indicative of aggressive scanning behavior.
Detects the abuse of SAP RFC function modules SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT to execute arbitrary OS commands. This activity, observed in the Operation Escaneo campaign, indicates potential unauthorized system command execution via SAP application components, often leveraging specific ZREDTEAM modules or scripts.
This rule detects potentially malicious activity within Oracle database audit and alert logs, specifically monitoring for the usage of packages like DBMS_SCHEDULER or UTL_FILE to execute OS commands or manipulate files. It also flags the execution of known exploit scripts or reconnaissance queries commonly associated with database-based attacks and unauthorized data dumping.
Detects execution of known reconnaissance tools and scripts associated with the Kimera framework, including subdomain and asset enumeration utilities (e.g., subfinder, nuclei, httpx) or custom Python scripts. The rule also monitors for reconnaissance-related ulimit adjustments and concurrent bursts of multiple enumeration tools, which are indicative of automated scanning activity.
Detects evidence of potential data exfiltration activities including the execution of known exfiltration scripts, the use of netcat for unauthorized data transfer to a specific C2 IP, and the presence or access of BloodHound dump files. The rule also monitors for network communication with a known command and control IP address.
Detects persistence mechanisms associated with the MYRA RAT on Linux systems, including the creation or modification of cron jobs (specifically targeting .cache-update.sh), registration of a malicious shared object via /etc/ld.so.preload, and the installation of a login hook in /etc/profile.d/.
Detects the creation of an interactive shell (e.g., bash -i, Python pty, socat) on a Linux host that simultaneously initiates an outbound network connection to an RFC-1918 private IP address. This pattern is characteristic of attackers using reverse shells for command and control or internal network reconnaissance, specifically matching behaviors associated with the MYRA RAT shell-pty plugin.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects the deployment and execution of the MeshCentral remote management agent on PeopleSoft servers, which is indicative of unauthorized access by the ShinyHunters threat group. The rule triggers on the execution of the meshctrl.js script using the RunCommand function with suspicious loopback WebSocket connections, or the direct execution of the meshagent binary from within the /opt/meshcentral/ directory.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects suspicious processes (e.g., node.exe, chost.exe, python) accessing sensitive credential files and subsequently exfiltrating data to the Telegram Bot API via HTTPS POST requests within a 10-minute window. This behavior is indicative of infostealer malware, such as those observed in the Friday Harvest campaign, harvesting and exfiltrating system data.
Page 223 of 347