Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the HTTP download of common boot script file types (batch, command, shell, PowerShell) that contain the string 'HKLM' (HKEY_LOCAL_MACHINE). This combination suggests an attempt to establish persistence or execute malicious code by modifying system-wide registry settings, often associated with trojan activity. The detection is based on the file extension in the URI and the content within the downloaded file's data.
This rule detects attempts to modify the shared library configuration file '/etc/ld.so' over an SSH connection. This activity is indicative of a shared library hijacking technique, often used for persistence or privilege escalation, where an attacker modifies the system's library loading paths to inject malicious libraries. The detection specifically looks for the string "/etc/ld.so" within TCP traffic destined for port 22 (SSH) on the home network.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
This rule looks for a non-interactive shell process reading npmrc token files outside normal developer activity. Automated readers often belong to stealers. Rotate npm tokens and check publish history. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects the remote installation of a new systemd service unit. It specifically looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "/etc/systemd/system/" and ".service" (case-insensitive). This combination suggests that a new systemd service file is being transferred or created remotely, which could indicate an attacker establishing persistence or escalating privileges.
Detects Linux VDSO hijacking for privilege escalation without syscalls
Detects download of malware builder or generator tools from code repositories
Detects creation of hidden files and directories via remote SSH for artifact hiding
Detects IP geolocation lookups used to determine system geographic location
Detects access to credential files through web shell commands
Detects automated social media account registration used for fake identity infrastructure
Detects the creation or execution of the SSH propagation payload script (.sshu-setup.js), used by the Hades stealer to propagate via SSH from compromised workstations. This rule identifies file creation/modification/renaming events for the specific script name, or process creation events where the command line references the script.
This rule detects the delivery of a kernel rootkit module, specifically a Linux Kernel Module (LKM) or a Windows system file, over HTTP. It looks for HTTP responses where the URI ends with '.ko' (Kernel Object for Linux) or '.sys' (system file for Windows) and the file data contains the 'ELF' magic bytes, indicating an Executable and Linkable Format file, which is common for Linux executables and modules. This combination suggests an attempt to deliver a malicious kernel module.
Detects command line activity indicative of probing endpoint detection and response (EDR) software directories such as CrowdStrike, Falcon, Carbon Black, and SentinelOne. The Miasma malware probes these exact paths to fingerprint host defenses before executing its credential theft module.
This rule detects attempts to create hidden files or directories in the /tmp directory on a remote host via SSH. Specifically, it looks for SSH traffic (tcp port 22) containing the strings "touch ." and "/tmp/." (case-insensitive). This behavior is often associated with adversaries attempting to hide their artifacts on a compromised system.
This rule detects attempts to clear the Bash history using the 'history -c' command over an established SSH connection. It specifically looks for the case-insensitive string 'history -c' within TCP traffic flowing from the client to the server on port 22 (SSH). This activity is often associated with an attacker attempting to cover their tracks after gaining unauthorized access.
This rule detects attempts to build a Docker image on a compromised host via the Docker API. It specifically looks for HTTP POST requests to the '/build' endpoint on port 2375, which is the default unsecured Docker API port. This activity could indicate an attacker leveraging a compromised system to build malicious Docker images.
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
Detects the execution of the zenity dialog tool spawned by unusual parents (like IDEs or bash scripts) to create fake password prompts on Linux. The Linux variant of UNK_DeadDrop utilizes this to trick developers into providing their system passwords, enabling root access and GNOME Keyring extraction.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Page 266 of 340