Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects use of custom encoding methods to archive data for exfiltration
Detects pulling of potentially malicious container images from registries
Detects connections to cryptocurrency mining pools
Detects installation of rootkit kernel modules for deep system hiding
Detects use of custom encoding methods to archive data for exfiltration
Detects internal proxy connections used to relay C2 traffic through network
Detects use of WHOIS web services for domain property enumeration
Detects exfiltration of sensitive data pushed to GitHub repositories
This rule detects a multi-step execution chain where Node.js (or npm) spawns a shell process, which then launches Bun. This pattern has been observed in malicious packages to hide the final payload from simple scanners. It is crucial to review the full parent-child process tree for any alerts. Users should be questioned about recent software installations or clicked links, and security teams should be involved if the activity is suspicious.
Detects the use of 'chattr +i' to make files immutable. This technique is used by malware, such as Miasma payloads, to prevent security tools and administrators from deleting malicious artifacts, hindering incident response and forensic analysis.
Detects reverse shell commands commonly established by SPECTRALVIPER to connect back to Miasma C2 infrastructure over /dev/tcp. This rule specifically looks for process creation events where the command line contains a bash, sh, or zsh command initiating an interactive shell and redirecting I/O to a /dev/tcp connection to an IP address and port, then redirecting stderr to stdout.
Detects when scripting language interpreters (Node, Python, Bun, NPM) create or modify files within the '/etc/cron.d/' directory. This activity is suspicious as it may indicate a compromised package or malicious actor attempting to establish system-wide persistence via scheduled tasks.
Detects non-standard scripts altering the authorized_keys file to inject attacker SSH public keys, providing persistent backdoor access to the compromised machine. Specifically looks for modifications or creations of 'authorized_keys' files by 'node', 'python', or 'bun' processes.
Detects process command lines that contain patterns indicative of obfuscated payload execution, specifically the combination of 'eval', 'base64', and '-d'. This technique is frequently used by adversaries to decode and execute memory-resident stages without dropping secondary payloads to disk.
Detects Node.js executing scripts matching a random temporary pattern (e.g., /tmp/pXXXXX.js). This pattern is generated by post-install scripts of malicious NPM packages, indicating potential supply chain compromise or malicious script execution.
Detects self-deletion commands (e.g., rm -f $0) used by Miasma payloads to remove their execution tracks from disk immediately after running. The rule specifically looks for process command lines containing 'rm', '-f', and either '$0' or '%~dp0', which are common patterns for self-deletion in shell scripts.
Detects the use of 'pgrep' to search for the 'Runner.Worker' process. This activity is often a precursor to an attacker attempting to access the process's memory via '/proc/[pid]/mem' for credential dumping or other malicious purposes.
Detects `grep` commands searching for the exact JSON structure (`"isSecret": true`) used by GitHub Actions to store masked secrets in memory. This activity could indicate an adversary attempting to discover sensitive information.
Page 252 of 340