Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects loading of kernel modules for deep system persistence
Detects SSH agent forwarding being abused for lateral movement
Detects Spring4Shell remote code execution exploitation attempts
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
This rule detects the creation of web shell files (ASPX, PHP, JSP) in common web server directories such as 'wwwroot', 'inetpub', or 'var\\www'. This activity is indicative of an adversary establishing persistent access to a web server.
Detects the loading of known trojanized native extensions (.abi3.so files) used in compromised bioinformatics PyPI packages (like ensmallen) as part of the Miasma/Hades campaign. Specifically targets 'ensmallen_haswell.abi3.so' and 'ensmallen_core2.abi3.so'.
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
This rule detects suspicious access to the UniFi OS JWT secret file (jwt.yaml) by processes other than the legitimate UniFi core components. It monitors for direct file access events (read, copy) and command-line executions that target the jwt.yaml file. This activity could indicate an attempt to extract sensitive credentials, potentially leading to unauthorized access or privilege escalation within the UniFi environment.
This rule detects the creation, modification, or renaming of files associated with PCPJack/TeamPCP malware on Linux systems. It specifically looks for these activities in common temporary directories (`/tmp/`, `/dev/shm/`, `/var/tmp/`) and for files with names matching known PCPJack/TeamPCP artifacts (e.g., `pcpcat`, `teampcp`, `xmrig`, `proxy.sh`, `kube.py`, `.pcpx`, `.pcp`) or hidden files (starting with a dot). This activity often indicates the initial staging or persistence mechanisms of the malware.
This rule detects network traffic containing the string "/etc/pam.d/" over TCP port 22 (SSH). This could indicate an attempt to modify Pluggable Authentication Modules (PAM) configuration files, potentially for authentication bypass or persistence on a Linux system. The detection is focused on traffic originating from the home network to the home network, suggesting internal activity or a compromised host communicating within the network.
This rule detects attempts to flush auditd rules by looking for the command 'auditctl -D' within TCP traffic on port 22 (SSH). This action is often performed by attackers to remove monitoring and evade detection after gaining access to a system.
This rule detects attempts to push firmware or bootkit images to a device via a remote SSH session. It specifically looks for the commands 'dd if=' and '/dev/' within TCP traffic directed to port 22 (SSH), indicating an attempt to write data directly to a device file, which is a common method for flashing firmware or installing bootkits.
This rule detects network traffic containing the string "signal(SIGTERM, SIG_IGN)" case-insensitively, indicating a process attempting to ignore the SIGTERM signal. This behavior can be used by malware or adversaries to achieve persistence on Linux systems by making a process harder to terminate gracefully.
This rule detects attempts to clear system log files, specifically '/var/log/', via a remote SSH connection. It looks for the string "> /var/log/" within TCP traffic on port 22 (SSH) flowing from a client to a server, ignoring case. This activity is often associated with an attacker trying to cover their tracks by removing evidence of their presence.
Detects Node.js or Bun processes making network connections to the GitHub API. This rule is designed to identify potential exfiltration attempts, specifically referencing the Miasma campaign which spoofs a 'python-requests/2.31.0' User-Agent to evade network detection while exfiltrating credentials to api.github.com/repos/.
This rule detects the creation of a systemd timer via a remote SSH session. It specifically looks for TCP traffic on port 22 (SSH) containing the commands 'systemctl enable' and '.timer' (case-insensitive), indicating an attempt to enable a systemd timer unit.
Monitors for network connections originating from the VSCode extension host process to GitHub API endpoints immediately following a new extension installation. This may indicate token exfiltration or repository enumeration from a malicious extension.
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Detects the creation of zip archives matching the specific naming convention (Unix-[HOSTNAME]-[ID].zip) used by the UnixStealer malware family. Detecting these host artifacts enables early discovery before successful exfiltration.
Detects the initial execution phase of the Phantom Gyp technique, which is used by the Miasma worm. This technique abuses the binding.gyp file with a command substitution pattern to execute a silent payload, bypassing standard npm lifecycle scripts.
Page 263 of 340