Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects command-line utilities such as grep, cat, sed, awk, or shell commands (bash, sh) being used to read the 'psappsrv.cfg' file and specifically searching for sensitive configuration parameters like 'Address=', 'HostName=', 'appserv', 'prcs', or 'ps_config_homes'. This activity could indicate an attacker attempting to discover system information or network configurations related to Oracle PeopleSoft.
Detects a MeshCentral agent launched from temporary directories or Oracle PeopleSoft application paths. This activity is often associated with remote access software used by adversaries.
Detects inspection of active mounts or /etc/hosts for PeopleSoft, configuration home, NFS, or environment naming patterns. This rule specifically looks for commands like 'mount', 'cat', 'grep', 'bash', or 'sh' being executed with command-line arguments that include 'mount' and PeopleSoft-related terms ('psoft', 'ps_config', 'nfs'), or '/etc/hosts' with PeopleSoft-related terms ('psoft', 'csprd', 'peoplesoft', 'psft').
Detects potential RondoDox botnet infection attempts by monitoring for the execution of common command-line tools (wget, busybox, curl) using specific flags (-qO-, -s) to download and pipe remote scripts from the known C2 IP 45.92.1.50 directly into a shell interpreter for execution.
Detects Python transmitting a newly created archive or JSON collection through requests, urllib, aiohttp, or a custom socket. This behavior is associated with the InvisibleFerret malware.
Detects Python enumerating browser extensions and desktop wallet paths associated with cryptocurrency key material. This rule specifically looks for Python processes executing with command-line arguments containing keywords related to cryptocurrency wallets (e.g., 'wallet', 'keystore', 'metamask').
Detects Python recursively searching repositories for .env files, package credentials, API keys, access tokens, or connection strings. This activity is associated with the InvisibleFerret malware.
Detects Python loading a .pyd or .so extension from common user-controlled or temporary directories (AppData, Temp, Downloads, Projects, /tmp/, /home/.../Downloads/) rather than a trusted package installation. This behavior is indicative of the InvisibleFerret malware, which uses Cython extensions for its operations.
Detects Python searching local vaults and configuration for password managers such as KeePass, 1Password, Bitwarden, or LastPass. This activity is associated with the InvisibleFerret malware.
Detects Python creating an archive containing browser, wallet, developer, cloud, and authentication data from multiple collection roots. This activity is associated with the InvisibleFerret malware.
Detects modifications to the .bashrc file by unexpected scripts (node, python). Miasma uses this to ensure payloads run every time a user opens a new terminal.
Detects the creation of 'update-monitor.service' in the systemd directory, a known persistence mechanism for the Miasma toolkit.
Detects the creation or modification of a 'setup.mjs' file within a '.vscode' directory. This script can act as a local payload execution point when developers open infected projects, potentially leading to arbitrary code execution.
Detects outbound network connections to 'seed1.getsession.org', a known Miasma Command and Control domain. This rule specifically looks for network events where the remote URL contains this domain, indicating potential C2 communication.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
Detects attempts to exfiltrate environment variables by piping the output of 'env' or 'printenv' commands into 'curl'. This technique can be used by adversaries, such as the Miasma malware, to quickly steal sensitive API keys or other credentials stored in environment variables.
Detects piping 'echo' directly into 'crontab -' to install cron jobs non-interactively, a standard method for scripted persistence.
Detects Python scripts utilizing ctypes, ptrace, or process_vm_readv to perform advanced, programmatic memory scraping without relying on shell utilities. This activity can be indicative of credential dumping or other forms of sensitive data exfiltration from process memory.
Detects execution of 'transformers.pyz', a zipped Python payload associated with the Miasma toolkit, by monitoring process creation events for command lines containing both 'python' and 'transformers.pyz'.
Detects the gh-token-monitor script using grep to extract GitHub Classic or Fine-Grained tokens (matching the ghp_ or gho_ structure) from the filesystem. This rule specifically looks for process command lines containing 'grep' and the regex pattern 'gh[po]_[a-zA-Z0-9]{36}', which is indicative of searching for GitHub tokens.
Page 250 of 340