Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Shellshock bash CGI exploitation attempts
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule searches CI logs and commands for patterns that extract GitHub secret values where isSecret is true. Automated secret scraping in pipelines leads to repository takeover. Audit workflow YAML changes. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects potential memory injection attempts on Linux systems via an SSH session. It specifically looks for the strings "/proc/" and "/mem" within TCP traffic directed to an SSH server ($HOME_NET 22). This combination of strings suggests an attempt to access or manipulate process memory, which is a common technique used by attackers for privilege escalation or code injection.
Detects instances where an executable is deleted immediately after execution, a common defense evasion technique used by memory-resident malware like the JDY botnet. This rule specifically looks for shell processes executing 'chmod +x' or 'chmod 777' followed by 'rm' commands, often chained with '&&', ';', or '||', indicating immediate self-deletion after execution.
This rule detects attempts to disable the Linux Auditd service via a remote SSH connection. It specifically looks for the string "systemctl stop auditd" within TCP traffic destined for port 22 (SSH). Disabling auditd can be an attempt by an attacker to evade detection by removing system auditing capabilities.
This rule detects attempts to clear syslog files by looking for the command 'truncate -s 0' followed by 'syslog' within an SSH session. This activity is often associated with an attacker trying to remove evidence of their presence on a compromised system.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects web-based access to log files indicating log tampering attempts
Detects dynamic domain resolution patterns used for C2 infrastructure rotation
Detects deployment of privileged Docker containers that may allow container escape
Detects repeated SSH authentication failures indicating password brute force
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by JavaScript runtimes (like node or bun). This activity may indicate a supply chain backdoor attempting to establish persistence within a project by modifying development environment configurations.
Detects download of malware source code from code repositories
Detects systemd timer unit file creation for Linux scheduled task persistence
Detects clearing of Linux system log files to remove forensic evidence
Detects enumeration of active network connections for discovery
Detects creation of large archives used to stage data for exfiltration
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Page 259 of 340