Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Detects the execution of the 'unshare' utility with arguments that create new user, network, and mount namespaces (-U, -n, -r) by a non-root user. This technique is often used to bypass namespace restrictions or perform privilege escalation by gaining elevated capabilities within a new, user-controlled namespace.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Detects suspicious child processes spawned from AutoGen Studio or mcp.py Python processes, which could indicate a WebSocket command injection vulnerability (AutoJack - CWE-78). The rule looks for common shell or command execution binaries and keywords in the process command line.
Matches the hardcoded VAPID Public Key string used by the extension to bypass browser sandboxes and wake the service worker, indicative of the SNOWBELT malware's command and control mechanism.
Detects attempts to restore or extract files containing path traversal characters ('../' or '..\') commonly associated with the ZipSlip vulnerability. This technique was utilized in Operation Escaneo (via the mkzip34.py tool) to deploy webshells automatically upon legitimate archive restoration. The rule specifically looks for file creation or modification events where the initiating process is a common archive extraction tool (unzip, tar) or a Java application server (java, tomcat), the file extension is for a Java web application (.jsp, .jspx), and the resulting folder path contains path traversal sequences.
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
Detects shell/script execution from .git/hooks/ paths, especially when spawning network-connected or unusual child processes. This activity is indicative of Lazarus Group exploiting Git Hooks for persistence and credential theft within developer environments.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects the presence and execution of known FortiBleed malware components based on their filenames and SHA256 hashes. It monitors both process creation events and file events to identify the malware.
This rule detects the presence and execution of known FortiBleed malware components based on their filenames and SHA256 hashes. It monitors both process creation events and file events to identify the malware.
Detects a shell script containing 'fanout' in its name, created or modified in common temporary directories like /tmp or /var/tmp, matching a reported propagation workflow. This activity is indicative of lateral movement attempts.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.
This rule detects the creation, modification, or renaming of the `authorized_keys` file within the `.ssh` directory by processes other than common SSH key management or shell utilities. This activity could indicate an adversary attempting to establish persistence or elevate privileges by adding their own public key for SSH access.
This rule detects various methods of establishing a reverse shell on Linux systems. It looks for process creation events involving common shell interpreters (bash, sh) attempting to connect to network devices via /dev/tcp or /dev/udp. It also identifies the use of network utilities like netcat (nc, ncat, netcat, nc.traditional) and socat when used with command execution flags (-e, -c, EXEC) and shell interpreters. Additionally, it flags direct outbound network connections initiated by these shell interpreters or network utilities, which could indicate a reverse shell communication channel.
This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.
Detects Python loading a .pyd or .so extension from common user-controlled directories like AppData, Temp, Downloads, or project directories, rather than from a trusted package installation. This behavior is indicative of the InvisibleFerret malware.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
Detects PHP or web server processes launching interpreters with encoded, Base64-decoded, or dynamically evaluated command content. This behavior is often indicative of web shell or backdoor execution. The rule specifically looks for web server processes (e.g., php.exe, w3wp.exe, httpd, nginx) as initiating processes, which then launch command interpreters (e.g., cmd.exe, powershell.exe, bash, python) with command lines containing obfuscation techniques like -EncodedCommand, FromBase64String, base64 -d, eval(), exec(), IEX, or Invoke-Expression.
This rule detects the use of 'curl' to perform HTTP PUT requests with binary data, a technique often employed by malware like Amos Stealer for data exfiltration. It specifically looks for command-line arguments '-X', 'PUT', and '--data-binary' in 'curl' process executions.
Page 245 of 347