Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects the creation of a named pipe (FIFO) in the /tmp directory combined with commands associated with establishing a reverse shell, such as using 'nc' or executing '/bin/bash -i' with piped input/output redirection. These patterns are commonly used by adversaries to gain unauthorized interactive remote shell access to a Linux system.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects SLURM job-queue enumeration (squeue/sinfo/scontrol) spawned specifically from a Python parent process, narrowing generic HPC admin commands to the mrmustard stealer's recon pattern.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects instances of 'pip' or 'git' being executed by a Python process to clone or install packages from external sources. This behavior is commonly used to install malicious or untrusted custom nodes within a ComfyUI environment, potentially facilitating initial access or code execution.
Detects the execution of 'az role assignment list' using the Azure CLI. This command is commonly used by adversaries to enumerate existing role assignments in an Azure environment, aiding in permission discovery and identifying potential targets for privilege escalation.
Detects process command lines using curl to query the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) for OAuth tokens. This behavior is indicative of an attacker attempting to leverage an Azure Managed Identity associated with a compromised virtual machine to obtain temporary security tokens for unauthorized access to other Azure resources.
Heuristic detection of high-entropy, obfuscated script content consistent with AI-generated (WormGPT-derived) malware formatted specifically to evade AV/EDR detection tooling
Detects the execution of 'sudo' or 'systemd-run' with specific flags often associated with automated credential processing or service creation for privilege escalation. The rule monitors for sudo commands using '-S' (read from stdin) and '-p' (custom prompt) flags, which are common in non-interactive scripts attempting to bypass or manipulate password prompts, and systemd-run commands using '--system' and '--no-ask-password', which can be used to run commands as root without interactive authentication.
Detects the use of shell interpreters (sh, bash, zsh) to download content from GitHub using curl (specifically using the -s silent flag) and subsequent base64 decoding of potentially obfuscated payloads using the base64 command with the -D flag.
Detects potential misuse of an Azure Managed Identity token on a Linux host, where 'curl' is used to interact with the Azure Key Vault API (vault.azure.net/secrets) while presenting an Authorization bearer token. This pattern can indicate an adversary who has obtained a Managed Identity token (e.g., via the Instance Metadata Service) and is attempting to exfiltrate or access sensitive secrets stored in Azure Key Vault.
Detects the execution of MokManager UEFI binaries or administrative activity via the mokutil utility targeting the MokListX denylist. This activity is indicative of Secure Boot configuration changes, such as enrolling unauthorized certificates or bypassing MOK (Machine Owner Key) denylist enforcement, which can facilitate the persistence or execution of malicious boot-level code.
Detects Python scripts initiating standard Linux system discovery commands such as id, uname, hostname, ifconfig, ip, or ps. This pattern is commonly used by adversaries for post-exploitation reconnaissance to profile the host environment.
Detects recurring kernel panic or oops events on KVM hosts occurring in rapid succession, typically within a 5-minute window. This behavioral pattern is consistent with an attacker repeatedly exploiting a race condition, such as a use-after-free (UAF) in the KVM shadow MMU, to trigger a persistent host denial-of-service.
Detects iptables INPUT/PREROUTING NAT rule insertions that ACCEPT inbound TCP traffic on a specific port, matching DOGLEASH's deployment script behavior of opening a firewall hole for its backdoor listening port.
Detects OS fingerprinting commands executed as child processes of a process that is actively listening on a network port, consistent with DOGLEASH.
Detects zip archives matching the .zx_ filename prefix convention used by CrashStealer to stage encrypted exfiltration data in /tmp prior to transmission to its C2 server.
This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.
Detects the execution of OS information gathering commands (e.g., uname, lsb_release) by a process that is also identified as having an active network listener. This pattern is indicative of passive backdoors or C2 agents performing reconnaissance of the host system after establishing a listener.
This rule detects the creation of unauthorized technician accounts in the SimpleHelp RMM platform that follow an OIDC authentication bypass pattern (CVE-2026-48558). It correlates server logs indicating 'New Anon' registration activity with Windows Security Event ID 4720 (User account created), specifically filtering for accounts that do not belong to trusted corporate domains.
Page 25 of 51