Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the JDY botnet's infection chain on Linux systems, characterized by script-based processor architecture reconnaissance followed by the retrieval, execution, and subsequent deletion of architecture-specific (MIPS) binaries. This rule monitors shell-based command sequences involving system information gathering, network-based file downloads, and immediate removal of the downloaded file.
Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.
Detects suspicious activity related to the OpenSSH server suite, including unauthorized modifications to core SSH binaries by non-package-manager processes, sshd processes writing files to temporary directories (a common indicator of credential harvesting), and sshd execution from non-standard file paths which may indicate a trojanized binary or persistence mechanism.
Detects network connections from common web browser processes (Chrome, Edge, Brave, Electron) to loopback addresses (127.0.0.1 or Localhost) where the URL path contains sensitive keywords like /code, /textbox, /credentials, or /secrets. This behavior is often associated with browser-based exploitation attempts, such as targeting local development servers or internal browser automation interfaces to extract sensitive information.
Detects Linux processes masquerading as common system utilities (e.g., sshd, cron, smbd) by executing from non-standard, often high-risk directories such as /tmp, /var/tmp, /dev/shm, /opt, or various home and dot-directories. This behavior is indicative of Velvet Ant's TTPs used to blend malicious binaries with standard system processes to maintain persistence and evade detection.
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
Detects MYRA RAT delivery via malicious npm package lifecycle scripts (e.g., postinstall) that trigger the compilation of native binaries such as libcache.so, memfd_loader, and others on Linux hosts.
Detects instances of the MYRA RAT process masquerading as the systemd-userdbd daemon. The detection identifies the malicious payload being executed from the /usr/lib/systemd/systemd-userdbd path with command-line arguments typically used by the legitimate system utility, indicating that the Node.js binary has been replaced or copied to evade detection.
Detects persistence mechanisms associated with the MYRA RAT on Linux systems, including the creation or modification of cron jobs (specifically targeting .cache-update.sh), registration of a malicious shared object via /etc/ld.so.preload, and the installation of a login hook in /etc/profile.d/.
Detects the execution of 'sudo npm install -g apintergrationpost', a known command pattern utilized by the MYRA RAT. This pattern leverages sudo for elevated privilege installation via a malicious npm package hook, facilitating potential privilege escalation.
Detects the use of screen capture utilities such as ffmpeg, grim, scrot, or xwd, which are often used by the MYRA RAT to capture live desktop sessions for exfiltration.
Detects the in-memory execution of the MYRA RAT on Linux systems. The rule identifies suspicious process activity where a process masquerades as the legitimate 'systemd-userdbd' service, while utilizing memfd_create or related file descriptor paths (e.g., /proc/self/fd/ or /memfd:) to load and execute malicious code directly from memory, thereby avoiding traditional file-based detection.
Detects the node.exe process deleting its own executing script file 'setup.cjs' located within an 'easy-day-js' node_modules directory. This behavior is indicative of the anti-forensics self-deletion mechanism used by the easy-day-js supply chain dropper to remove its footprint after executing a subsequent malicious payload.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Detects the 'procq' process establishing network connections to common Monero (XMR) mining pool ports. This behavior is indicative of a cryptominer deployment, specifically associated with the Langflow cryptominer campaign related to CVE-2026-33017.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects path traversal attempts in web server access logs by searching for dot-dot-slash (../), dot-dot-backslash (..\), or their URL-encoded equivalents (..). These patterns are indicative of efforts to access files or directories outside the intended web root.
This rule detects the execution of processes in CI/CD environments (such as runners, Jenkins, or GitLab) where the environment variable 'GEMINI_TRUST_WORKSPACE' is explicitly set to 'true'. This configuration is often used to grant elevated trust or access to workspace files during CI/CD workflows, which could be abused by an attacker to execute arbitrary code or access sensitive data if they can control the pipeline execution or workspace state.
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
Page 224 of 341