Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
Detects the execution of SSH or Plink processes with command-line arguments indicating local, remote, or dynamic port forwarding. Adversaries may use port forwarding to tunnel traffic through a compromised host to bypass network segment restrictions or access internal resources.
Detects the MYRA RAT utilizing npm postinstall scripts to silently install surveillance, build, or media capture tools (such as ffmpeg or grim) via apt-get in a non-interactive mode. This behavior is indicative of a supply chain attack or malicious dependency execution during package installation.
Detects the execution of an injector process associated with MYRA RAT, specifically monitoring for ptrace-based process injection techniques. The rule identifies processes attempting to attach to other processes using system calls like PTRACE_ATTACH, PTRACE_PEEKDATA, PTRACE_POKEDATA, or process_vm_writev. It also flags the specific behavior of spawning a 'sleep 600' decoy process as an injection target.
Detects reconnaissance activities associated with the MYRA RAT, specifically the enumeration of network connections by reading /proc/net/tcp and /proc/net/udp, originating from the systemd-userdbd process. This behavior is indicative of malware attempting to map network state via proc filesystem parsing.
Detects the use of sshpass to perform credential spraying against specific PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule triggers when sshpass is executed with disabled host key checking or batch mode, indicating automated, non-interactive authentication attempts.
Detects execution of processes originating from memory-only file descriptors (memfd) or the /proc/self/fd/ path, indicating fileless execution techniques often used by malware like MYRA RAT. This behavior is correlated with outbound network connections on port 4444 within a 2-minute window, which is indicative of command-and-control (C2) communication.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
This rule detects high-volume connection requests to LDAP services (default ports 389, 636, 3268, 3269). A high number of connections from a single source to a destination within a short time window may indicate automated reconnaissance, LDAP enumeration, or brute-force attempts against domain services.
Detects modification of scripts in extension folders.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects the creation of files with suspicious names (e.g., .xlamb, lambsys) in the /var/tmp directory, initiated by common command-line interpreters or network transfer utilities. This behavior is often indicative of malware deployment or staging in a Linux environment.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects Python executing a web-administration exploit with valid credential input and explicit two-factor bypass logic, matching the AI-assisted semantic trust-flaw exploitation described by GTIG.
Detects Python accessing AWS, Azure, Google Cloud, Kubernetes, Docker, Terraform, or Vault credential stores. This rule specifically looks for Python processes executing commands that contain keywords associated with cloud CLI credential files or configuration paths.
Detects instances where VS Code extension-related processes (such as amazonq-lsp or extensionHost) spawn shell processes (bash/sh) that subsequently initiate network activity via curl or wget. This pattern is indicative of potential exploitation where malicious workspace configuration files (e.g., .amazonq/mcp.json) are used to execute shell commands with unauthorized access to cloud credentials.
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Detects the execution of the 'unshare' utility with arguments that create new user, network, and mount namespaces (-U, -n, -r) by a non-root user. This technique is often used to bypass namespace restrictions or perform privilege escalation by gaining elevated capabilities within a new, user-controlled namespace.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Page 237 of 340