Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects path traversal attempts within HTTP request parameters, specifically identifying encoded traversal sequences, file protocol usage, and attempts to access sensitive system files like /etc/passwd or /proc/self/environ.
Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.
Detects instances where common web application processes (such as Flask, Django, Gunicorn) execute system utilities (curl, wget, etc.) to query the cloud metadata service URL (169.254.169.254) or domain names associated with instance metadata. This behavior is indicative of potential SSRF exploitation to retrieve cloud environment secrets or instance identity credentials.
Detects the use of Gsocket or gs-netcat utilities for outbound network connections on non-standard ports, as well as the execution of masqueraded 'uptime' binaries making network connections. It also monitors for DNS resolutions associated with Gsocket relay infrastructure to identify potential command and control or unauthorized tunneling attempts.
Detects the JDY botnet's infection chain on Linux systems, characterized by script-based processor architecture reconnaissance followed by the retrieval, execution, and subsequent deletion of architecture-specific (MIPS) binaries. This rule monitors shell-based command sequences involving system information gathering, network-based file downloads, and immediate removal of the downloaded file.
Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.
Detects suspicious activity related to the OpenSSH server suite, including unauthorized modifications to core SSH binaries by non-package-manager processes, sshd processes writing files to temporary directories (a common indicator of credential harvesting), and sshd execution from non-standard file paths which may indicate a trojanized binary or persistence mechanism.
Detects network connections from common web browser processes (Chrome, Edge, Brave, Electron) to loopback addresses (127.0.0.1 or Localhost) where the URL path contains sensitive keywords like /code, /textbox, /credentials, or /secrets. This behavior is often associated with browser-based exploitation attempts, such as targeting local development servers or internal browser automation interfaces to extract sensitive information.
Detects Linux processes masquerading as common system utilities (e.g., sshd, cron, smbd) by executing from non-standard, often high-risk directories such as /tmp, /var/tmp, /dev/shm, /opt, or various home and dot-directories. This behavior is indicative of Velvet Ant's TTPs used to blend malicious binaries with standard system processes to maintain persistence and evade detection.
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
Detects instances of the MYRA RAT process masquerading as the systemd-userdbd daemon. The detection identifies the malicious payload being executed from the /usr/lib/systemd/systemd-userdbd path with command-line arguments typically used by the legitimate system utility, indicating that the Node.js binary has been replaced or copied to evade detection.
Detects the execution of 'sudo npm install -g apintergrationpost', a known command pattern utilized by the MYRA RAT. This pattern leverages sudo for elevated privilege installation via a malicious npm package hook, facilitating potential privilege escalation.
Detects the use of screen capture utilities such as ffmpeg, grim, scrot, or xwd, which are often used by the MYRA RAT to capture live desktop sessions for exfiltration.
Detects the in-memory execution of the MYRA RAT on Linux systems. The rule identifies suspicious process activity where a process masquerades as the legitimate 'systemd-userdbd' service, while utilizing memfd_create or related file descriptor paths (e.g., /proc/self/fd/ or /memfd:) to load and execute malicious code directly from memory, thereby avoiding traditional file-based detection.
Detects the node.exe process deleting its own executing script file 'setup.cjs' located within an 'easy-day-js' node_modules directory. This behavior is indicative of the anti-forensics self-deletion mechanism used by the easy-day-js supply chain dropper to remove its footprint after executing a subsequent malicious payload.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Detects the 'procq' process establishing network connections to common Monero (XMR) mining pool ports. This behavior is indicative of a cryptominer deployment, specifically associated with the Langflow cryptominer campaign related to CVE-2026-33017.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects path traversal attempts in web server access logs by searching for dot-dot-slash (../), dot-dot-backslash (..\), or their URL-encoded equivalents (..). These patterns are indicative of efforts to access files or directories outside the intended web root.
This rule detects the execution of processes in CI/CD environments (such as runners, Jenkins, or GitLab) where the environment variable 'GEMINI_TRUST_WORKSPACE' is explicitly set to 'true'. This configuration is often used to grant elevated trust or access to workspace files during CI/CD workflows, which could be abused by an attacker to execute arbitrary code or access sensitive data if they can control the pipeline execution or workspace state.
Page 232 of 347