Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects attempts to unset the HISTFILE environment variable over a TCP connection to port 22 (SSH). Unsetting HISTFILE is a common technique used by attackers to prevent their commands from being recorded in the shell history, thereby evading detection and forensic analysis. The rule specifically looks for the string "unset HISTFILE" case-insensitively within the TCP stream.
This rule detects attempts to harvest credentials from process memory on Linux systems. It specifically looks for HTTP traffic (flow:to_client,established) containing both the string "/proc/self/mem" and "password" (case-insensitive) within the file data. This combination suggests a tool or script is attempting to read memory for credential extraction, often associated with techniques like credential dumping.
This rule detects attempts to extract credentials from the Linux /proc filesystem over an SSH connection. Specifically, it looks for network traffic containing "/proc/", "/mem", and "ssh" (case-insensitive) within the same TCP flow to a server on port 22. This combination suggests an attacker might be trying to read sensitive memory regions or files related to SSH processes to dump credentials.
This rule detects attempts to read the bash history file, typically using the 'cat ~/.bash_history' command, over a TCP connection to port 22 (SSH). This activity is often associated with credential harvesting by an attacker who has gained access to a system and is looking for sensitive information, such as previously entered commands that might contain passwords or other credentials.
Detects process execution indicative of the npm binding.gyp GYP shell expansion exploit used in the Miasma campaign to silently run node. This rule specifically looks for Node.js process executions with a command line matching a unique regex pattern associated with the exploit: 'node index.js > /dev/null 2>&1 && echo stub.c'.
Detects commands writing to authorized_keys files, a common SSH persistence method.
Detects creation of malicious stored procedures in SQL databases
Identifies web server processes dropping PHP files. This is a strong indicator of web shell persistence following a successful PHP object injection or remote code execution attack in WordPress environments.
Detects the anomalous download or extraction of the Bun JavaScript runtime. The Miasma worm downloads Bun during npm/node-gyp installation phases to execute its payloads outside of standard Node.js monitoring, evading detection.
Detects error-log indicators of active CVE-2026-42945 (NGINX Rift) exploitation attempts
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
Hades Sentinel File Creation
Cortex XDR
Detects the creation of the '.bun_ran' sentinel file in the system temp directory, used by the Hades malicious PyPI loader to avoid repeated executions. This file acts as a marker to prevent subsequent infections or executions of the malware.
Detects installation or execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets).
This rule detects the delivery of a payload containing the string "/proc/self/mem" over HTTP to a client. This string is often associated with process memory write injection techniques, particularly on Linux systems, where an attacker might attempt to write malicious code directly into a process's memory space by interacting with the /proc/self/mem pseudo-file. The rule specifically looks for this content within the file data of an HTTP response flowing to the client.
Detects launching shells with history disabled via environment variables (separate from deleting history files),
consistent with impairing command history logging (Defense Evasion).
consistent with impairing command history logging (Defense Evasion).
Detects processes attempting to scrape unmasked CI runner secrets from memory or using specific grep patterns associated with the Miasma worm. The worm escalates privileges to read Runner.Worker memory directly, bypassing standard GitHub Actions secret masking.
This rule detects attempts to escalate privileges using 'sudo su -' over an SSH connection. It specifically looks for the string 'sudo su -' within TCP traffic on port 22, indicating a potential privilege escalation attempt after an SSH session has been established.
This rule detects network traffic containing the string "/etc/rc" over SSH (port 22) to a server within the home network. This pattern suggests an attempt to modify an RC script for persistence on a Linux system, potentially by an attacker who has gained SSH access.
This rule detects the use of the 'trap' command with 'EXIT' in TCP traffic, which is a common technique used for persistence on Unix-like systems. Attackers can use the 'trap' command to execute arbitrary commands when a shell exits, ensuring their malicious code runs even after a session is closed.
This rule detects the delivery of potentially malicious kernel modules or extensions over HTTP. It specifically looks for HTTP responses containing files with '.ko' (Linux kernel object) or '.kext' (macOS kernel extension) file extensions in the URI, indicating a client is downloading such a file. The 'flow:to_client,established' ensures the detection occurs on files being sent from a server to a client over an established HTTP connection.
This rule detects attempts to hijack the dynamic linker's LD_PRELOAD mechanism over an SSH connection. It specifically looks for the string "LD_PRELOAD" within TCP traffic on port 22 (SSH). This technique is often used by attackers for persistence or privilege escalation by injecting malicious libraries into legitimate processes.
Page 265 of 340