Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the main file executed.
This rule detects potential exploitation attempts related to the 'Squidbleed' vulnerability (CVE-2021-28116) by monitoring 'squid.exe' process command lines for keywords indicative of stack variable overflow exploitation in its FTP parser. Specifically, it looks for the presence of terms like 'stack', 'heap', 'offset', 'buffer', or 'pointer' combined with 'overread', 'overflow', or 'bounds'.
This rule detects the execution of iptables or xtables commands to create a network redirection rule. Specifically, it looks for commands that use 'REDIRECT', '--to-ports', and either 'PREROUTING' or 'nat' in the command line, indicating an attempt to redirect network traffic, potentially for proxying or other malicious network manipulation.
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects the execution or presence of a script named 'proxyshell_01.sh' in process command lines. This script has been associated with MuddyWater activity, specifically in the context of exploiting ProxyShell vulnerabilities.
This rule detects attempts by non-browser processes to access sensitive Chromium-based browser files such as 'Login Data', 'Cookies', 'History', 'Web Data', and 'Local State'. These files often contain credentials, browsing history, and other sensitive user data. The rule specifically filters for file access events where the accessing process's command line does not match known browser executables (chrome.exe, msedge.exe, brave.exe, opera.exe, vivaldi.exe), indicating potential credential theft or data exfiltration by malicious software.
Correlates the execution of a script from a cloned repository accessing developer credential stores (SSH keys, AWS profiles) within a tight time window. This rule specifically looks for file access events on common credential files (id_rsa, credentials, config) within sensitive directories (.ssh, .aws, .kube) that are initiated by a process whose command line contains keywords often associated with development activities or social engineering lures (interview, test, assignment).
Detects the execution of base64 decoded payloads in memory by interpreted languages such as Python or Node.js. This rule specifically looks for command-line arguments indicating base64 decoding or zlib decompression operations.
Detects instances where AutoGenStudio or MultimodalWebSurfer processes spawn potentially malicious or living-off-the-land (LOLBin) child processes. This behavior may indicate an exploit chain where a web-based RCE leads to arbitrary command execution on the host system.
Detects network activity and DNS lookups associated with the domain 'loopedin.io', which has been identified as a second-hop open-redirect service used in forged healthcare-themed phishing campaigns. The rule specifically monitors connections from common web browsers to facilitate the identification of redirected user traffic.
This rule monitors network traffic for outbound connections to a specific remote IP address (38.60.253.35) on port 8084. This pattern is indicative of communication with a known command-and-control server or malicious infrastructure.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Correlates the creation and immediate deletion of the 'trin.tar.gz' archive, which is handled by the Python temporary-directory context manager, indicating potential malicious activity associated with TeamPCP.
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
Detects instances where a process command line includes both 'base64' and '.env', indicating potential encoding of sensitive .env files. Attackers often encode these files before exfiltration to bypass basic Data Loss Prevention (DLP) string matching and obscure the data.
Detects evidence of exploitation targeting a use-after-free vulnerability in the c-ares DNS library. The rule monitors for three primary indicators: abnormal child process creation (e.g., cmd.exe or calc.exe) originating from applications known to link against c-ares (like node.exe or curl.exe), the presence of specific proof-of-concept (PoC) artifact files on disk, and the direct execution of identified c-ares exploitation harness binaries or scripts.
Detects anomalous child process creation from FFmpeg-related binaries (ffmpeg, ffplay, ffprobe) indicative of arbitrary code execution stemming from memory corruption vulnerabilities in the RASC/DLTA codec handler.
Detects attempts to perform a container escape via the docker cp command by abusing path traversal vulnerabilities or suspicious file write operations performed by the Docker daemon to the host filesystem outside of standard container paths, often associated with symbolic link extraction exploits.
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers. MITRE ATT&CK: T1046, T1082 References: - https://www.bleepingcomputer.com/news/security/oracle-peoplesoft-servers-hacked-in-shinyhunters-data-theft-attacks/
Page 246 of 347