Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the initial execution phase of the Phantom Gyp technique where a node-gyp rebuild command is abused to execute a silent payload and return a fake C stub file. This behavior is associated with the Miasma npm supply chain attack.
Detects Shellshock bash CGI exploitation attempts
Detects creation of XDG autostart entries for Linux desktop persistence
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects processes ignoring termination signals to prevent shutdown
Detects access to AWS credentials files for cloud account credential theft
Detects legitimate software deployment tools used for remote execution
Detects creation of XDG autostart entries for Linux desktop persistence
Detects cron job creation for Linux persistence or execution
Detects use of raw sockets for implementing socket filter backdoors
Detects compilation of delivered source code payloads to evade file-based detection
Detects Unix shell commands executed via web application context
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects attempts to create a setuid binary on a remote host via an SSH connection. It specifically looks for the string "chmod u+s" within TCP traffic destined for port 22 (SSH), indicating a command to set the setuid bit on a file. This activity is often associated with privilege escalation attempts where an attacker tries to create a backdoor or maintain persistence with elevated privileges.
This rule detects network traffic containing the string ".bashrc" on TCP port 22 (SSH). This could indicate an attempt to modify a user's shell profile for persistence, as .bashrc is a common file used to configure the Bash shell environment and can be leveraged by attackers to execute malicious commands upon login.
This rule detects attempts to modify the SSH daemon configuration file (sshd_config) remotely over an established TCP connection to port 22. The detection is based on the presence of the string "sshd_config" within the network flow, indicating potential remote manipulation of SSH authentication settings.
Detects the execution of the MinIO client (mc) with insecure connection parameters, indicating potential automated data exfiltration to S3-compatible storage by threats like BLUERABBIT. The rule specifically looks for the 'alias', 'set', and '--insecure' arguments in the process command line.
Hades Bun Payload Execution
Cortex XDR
Detects the execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This indicates potential malicious activity associated with the Hades PyPI campaign.
This rule detects attempts to write or modify cron persistence entries via HTTP. Specifically, it looks for HTTP client body content containing the string "/etc/cron" (case-insensitive). This indicates a potential attacker trying to establish persistence on a Linux system by scheduling malicious tasks.
Detects malicious Docker image builds on compromised hosts for persistence
Page 262 of 340