Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects modifications to user profile scripts (.profile, .bash_profile) that inject 'gh-token-monitor' or 'spectralviper' to establish persistence upon user login.
Detects the creation of hidden files (starting with a dot) in the `/tmp` directory on Linux systems. This behavior can be indicative of malware like Miasma hiding intermediate exfiltration data or configuration files.
Detects unauthorized access to the .npmrc file by unusual processes. Miasma targets this file to hijack NPM publishing rights and propagate supply chain attacks. The rule specifically looks for file access events on '.npmrc' where the initiating process is not a known legitimate NPM-related tool like 'npm', 'node', 'bun', or 'yarn'.
Detects instances where 'wget' is used to download content and pipe it directly into a shell interpreter (bash, sh, or zsh). This technique is often used for fileless execution, allowing adversaries to download and execute malicious scripts without writing them to disk.
Identifies execution of the Python credential stealer script named detect_malware.py, associated with the UNK_DeadDrop phishing campaign.
Detects Python processes accessing sensitive credential paths, a common post-exploitation step for malicious ML models (e.g., CVE-2026-4372). The rule specifically looks for Python executables accessing paths commonly associated with cloud (AWS) or container (Kubernetes) credentials. It includes exclusions for known legitimate ML pipeline scripts to reduce noise.
Detects modification of SSH authorized_keys files for backdoor access
Detects enumeration of Docker containers and images
Identifies shell commands associated with downloading architecture-specific payloads (e.g., mips, mipsel) commonly used by IoT/SOHO botnet droppers like the JDY botnet.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
This rule detects the use of the 'chattr +i' command over a network connection to port 22 (SSH). The 'chattr +i' command on Linux is used to make a file immutable, meaning it cannot be modified, deleted, or renamed, even by the root user. This behavior can be indicative of an attacker attempting to prevent forensic analysis or hinder system recovery by protecting their malicious files or modifying critical system files.
This rule detects attempts to copy the /etc/shadow file, which contains hashed user passwords, for offline password cracking. It specifically looks for the string "cat /etc/shadow" in TCP traffic destined for the home network on any port, indicating a potential exfiltration attempt or preparation for credential access. The rule is designed to alert on established connections where this specific command is observed.
Detects creation of malicious container services via Docker API for persistence
Detects Linux ptrace system call abuse for process injection
Detects downloads of executable scripts directly from raw GitHub URLs
Detects automated credential spraying and lateral movement attempts using the sshpass utility targeting common Oracle/PeopleSoft usernames. This specific combination of parameters and targeted accounts matches the bash script deployment mechanism utilized by the ShinyHunters extortion gang.
Detects queries to internet-wide scan databases for target infrastructure reconnaissance
Detects creation of setuid binaries used for Linux privilege escalation
This rule detects process command lines that indicate an attempt to execute a one-line install command from a GitHub raw content URL, often associated with untrusted or malicious projects. It specifically looks for common command-line tools used for downloading and executing scripts (like iex, Invoke-WebRequest, curl, wget, msiexec, Start-Process) in conjunction with keywords suggesting fake software or plugins (e.g., ChatGPT, Claude, AutoTune, Kontakt, plugin, installer).
This rule detects the execution of the 'dd if=/dev/zero' command over an SSH connection. This command is commonly used to wipe disk content by overwriting it with zeros, which can be an indicator of malicious activity aimed at destroying data or hindering forensic analysis. The rule specifically looks for this string within TCP traffic directed to port 22 (SSH).
Page 265 of 347