Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This YARA rule detects the presence of a credential stealer by identifying a cluster of file names commonly associated with Firefox profile data. The rule specifically looks for at least five out of seven distinct file names: 'key4.db', 'cert9.db', 'cookies.sqlite', 'logins.json', 'formhistory.sqlite', 'places.sqlite', and 'prefs.js'. These files are critical components of a Firefox profile, storing sensitive information such as encryption keys, certificates, cookies, login credentials, browsing history, and user preferences. The co-occurrence of these file names within a scanned target suggests an attempt to access, exfiltrate, or manipulate Firefox user data, often indicative of malware like credential stealers.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
This rule detects a multi-step execution chain where Node.js (or npm) spawns a shell process, which then launches Bun. This pattern has been observed in malicious packages to hide the final payload from simple scanners. It is crucial to review the full parent-child process tree for any alerts. Users should be questioned about recent software installations or clicked links, and security teams should be involved if the activity is suspicious.
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects use of custom encoding methods to archive data for exfiltration
Detects pulling of potentially malicious container images from registries
Detects installation of rootkit kernel modules for deep system hiding
Detects use of custom encoding methods to archive data for exfiltration
Detects internal proxy connections used to relay C2 traffic through network
Detects use of WHOIS web services for domain property enumeration
Detects exfiltration of sensitive data pushed to GitHub repositories
This rule finds Bun extracted to a temporary folder during npm install on a machine that does not normally use Bun. Temp paths hide binaries from casual inspection. Remove the package and scan the host. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects the use of 'chattr +i' to make files immutable. This technique is used by malware, such as Miasma payloads, to prevent security tools and administrators from deleting malicious artifacts, hindering incident response and forensic analysis.
Detects reverse shell commands commonly established by SPECTRALVIPER to connect back to Miasma C2 infrastructure over /dev/tcp. This rule specifically looks for process creation events where the command line contains a bash, sh, or zsh command initiating an interactive shell and redirecting I/O to a /dev/tcp connection to an IP address and port, then redirecting stderr to stdout.
Detects when scripting language interpreters (Node, Python, Bun, NPM) create or modify files within the '/etc/cron.d/' directory. This activity is suspicious as it may indicate a compromised package or malicious actor attempting to establish system-wide persistence via scheduled tasks.
Detects non-standard scripts altering the authorized_keys file to inject attacker SSH public keys, providing persistent backdoor access to the compromised machine. Specifically looks for modifications or creations of 'authorized_keys' files by 'node', 'python', or 'bun' processes.
Detects process command lines that contain patterns indicative of obfuscated payload execution, specifically the combination of 'eval', 'base64', and '-d'. This technique is frequently used by adversaries to decode and execute memory-resident stages without dropping secondary payloads to disk.
Page 259 of 347