Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
Detects the execution of SSH or Plink processes with command-line arguments indicating local, remote, or dynamic port forwarding. Adversaries may use port forwarding to tunnel traffic through a compromised host to bypass network segment restrictions or access internal resources.
Detects the MYRA RAT utilizing npm postinstall scripts to silently install surveillance, build, or media capture tools (such as ffmpeg or grim) via apt-get in a non-interactive mode. This behavior is indicative of a supply chain attack or malicious dependency execution during package installation.
Detects the execution of an injector process associated with MYRA RAT, specifically monitoring for ptrace-based process injection techniques. The rule identifies processes attempting to attach to other processes using system calls like PTRACE_ATTACH, PTRACE_PEEKDATA, PTRACE_POKEDATA, or process_vm_writev. It also flags the specific behavior of spawning a 'sleep 600' decoy process as an injection target.
Detects reconnaissance activities associated with the MYRA RAT, specifically the enumeration of network connections by reading /proc/net/tcp and /proc/net/udp, originating from the systemd-userdbd process. This behavior is indicative of malware attempting to map network state via proc filesystem parsing.
Detects the use of sshpass to perform credential spraying against specific PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule triggers when sshpass is executed with disabled host key checking or batch mode, indicating automated, non-interactive authentication attempts.
Detects execution of processes originating from memory-only file descriptors (memfd) or the /proc/self/fd/ path, indicating fileless execution techniques often used by malware like MYRA RAT. This behavior is correlated with outbound network connections on port 4444 within a 2-minute window, which is indicative of command-and-control (C2) communication.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
This rule detects high-volume connection requests to LDAP services (default ports 389, 636, 3268, 3269). A high number of connections from a single source to a destination within a short time window may indicate automated reconnaissance, LDAP enumeration, or brute-force attempts against domain services.
Detects modification of scripts in extension folders.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects the creation of files with suspicious names (e.g., .xlamb, lambsys) in the /var/tmp directory, initiated by common command-line interpreters or network transfer utilities. This behavior is often indicative of malware deployment or staging in a Linux environment.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects Python executing a web-administration exploit with valid credential input and explicit two-factor bypass logic, matching the AI-assisted semantic trust-flaw exploitation described by GTIG.
Detects Python or a shell replacing the installed Chrome build with an older package before installing a wallet extension that requires Manifest V2 capabilities. This activity is associated with the InvisibleFerret malware.
Detects Python accessing AWS, Azure, Google Cloud, Kubernetes, Docker, Terraform, or Vault credential stores. This rule specifically looks for Python processes executing commands that contain keywords associated with cloud CLI credential files or configuration paths.
Detects instances where VS Code extension-related processes (such as amazonq-lsp or extensionHost) spawn shell processes (bash/sh) that subsequently initiate network activity via curl or wget. This pattern is indicative of potential exploitation where malicious workspace configuration files (e.g., .amazonq/mcp.json) are used to execute shell commands with unauthorized access to cloud credentials.
Detects the spawning of shells (bash, sh) or utility processes (npx) as child processes of Amazon Q or VS Code extension host components. This activity is indicative of exploitation attempts involving malicious Model Context Protocol (MCP) server configurations within workspace environments, as identified by CVE-2026-12957.
Page 244 of 347