Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the Miasma worm utilizing the Bun runtime to execute malicious payloads. The detection looks for Bun processes executing scripts from /tmp/, specifically patterns associated with the Miasma worm, or processes matching the known malicious Bun runtime hash.
Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.
This rule detects various methods of establishing a reverse shell on Linux systems. It looks for process creation events involving common shell interpreters (bash, sh) attempting to connect to network devices via /dev/tcp or /dev/udp. It also identifies the use of network utilities like netcat (nc, ncat, netcat, nc.traditional) and socat when used with command execution flags (-e, -c, EXEC) and shell interpreters. Additionally, it flags direct outbound network connections initiated by these shell interpreters or network utilities, which could indicate a reverse shell communication channel.
Detects anomalous activity associated with Amazon Q processes, including unauthorized access to SSH agent binaries, attempts to read SSH configuration files or keys in ~/.ssh/, and suspicious outbound network connections over port 22, potentially indicating lateral movement.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects the use of AppArmor administrative and diagnostic tools (aa-exec, aa-status, apparmor_parser) with non-root accounts, or usage containing flags indicative of profile bypass attempts or privilege restriction probing.
Detects the creation or modification of '.amazonq.mcp.json' files associated with the Model Context Protocol (MCP) in VS Code or similar IDE environments, alongside the subsequent spawning of shell interpreters (bash, sh, cmd, powershell, python, npx) from these IDE processes. The rule further flags these events as 'HIGH' priority if the command line references sensitive patterns like AWS credentials or SSH/AWS paths, suggesting potential credential harvesting or unauthorized post-exploitation activity originating from the IDE environment.
Detects instances where the Amazon Q language server or VS Code extension host spawns suspicious child processes, such as shells, interpreters (python, bash, powershell), or utilities commonly used to query or extract AWS cloud credentials.
Detects attempts to modify or bypass AppArmor security profiles using utilities such as aa-complain, aa-disable, or apparmor_parser, correlated with process execution involving user namespace unsharing (e.g., via unshare or CLONE_NEWUSER/CLONE_NEWNET). This combination suggests an attacker attempting to weaken host security controls or perform a container breakout or privilege escalation by manipulating kernel-level namespaces and security policies.
Detects instances where common shell or command-line tools are spawned by Amazon Q processes (amazonq-language-server) or development-related processes (Code.exe, node) shortly after the creation or access of the 'mcp.json' configuration file within an '.amazonq' directory. This behavior may indicate an attacker using development tool vulnerabilities or compromised extensions to execute arbitrary commands.
This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.
Detects execution of exploit binaries associated with CVE-2026-46331 (pedit COW) or the abuse of legitimate 'tc' (traffic control) and 'unshare' utilities to perform page cache corruption and privilege escalation in user namespace contexts.
Detects the creation of an mcp.json file within the .amazonq directory, followed shortly by the execution of suspicious child processes (bash, python, curl, etc.) by VS Code (Code.exe). This pattern is often indicative of an adversary abusing developer tools or IDE extensions to perform credential discovery or data exfiltration from a development environment.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
This rule detects DNS queries to known public tunneling service domains, such as devtunnels.ms, loophole.site, loca.lt, and bore.pub, originating from processes other than the legitimate developer tunneling tools (devtunnel.exe, code.exe, code-tunnel.exe). This activity is highly indicative of unauthorized remote access or command-and-control communication.
This rule detects various techniques used by the Lambsys malware for persistence, watchdog monitoring, and cryptocurrency mining on Linux systems. It monitors for crontab modifications, the execution of hidden watchdog scripts in /var/tmp, the usage of pgrep to monitor the miner, and the detachment of processes via nohup.
This rule detects suspicious activities related to SSH credential theft and lateral movement on Linux systems. It monitors for interactive shells or utilities like cat, python, and bash accessing common SSH configuration files (~/.ssh/id_rsa, authorized_keys, etc.), as well as automated SSH/SCP sessions using suspicious configurations (BatchMode=yes, StrictHostKeyChecking=no) or specific malicious payloads.
This rule detects activities related to the DirtyClone exploit (CVE-2026-43503), including the execution of the exploit binary, the compilation of the exploit from source code using gcc, the use of unshare to prepare network and user namespaces, and suspicious execution of su by non-standard parent processes indicating potential post-exploit root shell acquisition.
Detects the execution of potentially suspicious cleanup and maintenance commands (e.g., clearing history, changing permissions, removing files) on Linux systems that are often associated with post-exploitation activity or evidence removal. The rule monitors for these patterns specifically when initiated by commands involving common suspicious file paths like 'isp.sh', 'lambsys', or '/var/tmp/.xlamb'.
Detects a sequence of suspicious activities characteristic of an SSH-based worm. The rule correlates non-standard processes reading SSH private keys, the presence of known cryptominer components (lambsys, procq, isp.sh), and subsequent SSH network fan-out activity from the same host, indicating lateral movement.
This rule detects attempts to disable, stop, or tamper with security-critical Linux system services and configurations. This includes stopping AppArmor, disabling firewalls (iptables, nftables, ufw), disabling SELinux, and modifying file attributes with 'chattr' to potentially hinder security monitoring or unauthorized file modifications.
Page 226 of 347