Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects network traffic that contains specific strings indicative of a Systemd service unit being created for persistence. Specifically, it looks for the string "/etc/systemd/system" and ".service" within TCP traffic directed to the home network on port 22 (SSH). This combination suggests an attempt to establish persistence on a Linux system by creating a new Systemd service.
This rule flags many npm republications from an account soon after suspicious token activity. Stolen maintainer tokens cause rapid malicious releases. Lock the account and audit download stats. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
This rule detects the string "systemctl enable" within TCP traffic on port 22 (SSH). This indicates an attempt to enable a systemd service on a remote Linux host via an established SSH connection. This activity could be part of legitimate system administration but also could be indicative of an attacker persisting a malicious service.
Detects upload of malicious modules to web server application directories
Detects C2 commands triggering disk wipe operations for destructive impact
Detects SSH connections between internal hosts indicating lateral movement
Detects raw disk volume access used to bypass file system security controls
Detects systemctl used to enable or start services for Linux execution
Detects creation of archives for staging collected data before exfiltration
Detects LD_PRELOAD environment variable set to load malicious shared libraries
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
This rule detects potential data exfiltration or unauthorized copying of data from USB drives via an SSH SCP session. It specifically looks for TCP traffic on port 22 (SSH) within the home network, where the data flow is from the client to the server (upload). The rule triggers if the content of the SCP session includes both "/media/" and "/usb" (case-insensitive), indicating paths commonly associated with mounted USB devices on Linux systems, and the data size is greater than 1000 bytes. This suggests that contents from a USB drive are being copied off the system over SSH.
This rule detects the creation of a tar archive using the 'tar -czf' command, specifically when the archive is being created in the '/tmp/' directory over an SSH connection. This activity is indicative of data staging, where an attacker might be preparing data for exfiltration or further malicious use.
Docker Image Enumeration via API
Suricata
This rule detects attempts to enumerate Docker images via the Docker API. Specifically, it looks for HTTP requests to the '/images/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity can indicate an adversary performing reconnaissance on a system to understand its Docker environment.
This rule detects attempts to perform raw disk access via SSH, specifically looking for the 'dd if=/dev/sd' command within SSH traffic. This activity could indicate an attacker trying to bypass volume-based security controls or exfiltrate data directly from disk partitions.
This rule detects network traffic containing the string "chmod 777" followed by "/tmp/" (case-insensitive) within a TCP flow to a server on port 22. This pattern suggests an attempt to change file permissions to world-writable (777) in the /tmp directory, which is a common tactic used by malware to hide or execute malicious files.
This rule detects attempts to grep for passwords within the bash history file over an SSH connection. Specifically, it looks for the string 'grep -i password ~/.bash_history' in TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker attempting to discover credentials on a compromised system.
This rule detects attempts to perform process injection using the 'ptrace' system call, specifically looking for 'ptrace' and 'PTRACE_ATTACH' within TCP traffic destined for SSH (port 22). This activity is indicative of an attacker trying to attach to a running process, often for debugging, modifying its memory, or injecting malicious code, potentially after gaining remote access via SSH.
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Page 261 of 340