Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects processes ignoring termination signals to prevent shutdown
Detects legitimate software deployment tools used for remote execution
Detects compilation of delivered source code payloads to evade file-based detection
Detects Shellshock bash CGI exploitation attempts
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
Detects cron job creation for Linux persistence or execution
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
This rule detects the creation of web shell files (ASPX, PHP, JSP) in common web server directories such as 'wwwroot', 'inetpub', or 'var\\www'. This activity is indicative of an adversary establishing persistent access to a web server.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule searches CI logs and commands for patterns that extract GitHub secret values where isSecret is true. Automated secret scraping in pipelines leads to repository takeover. Audit workflow YAML changes. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects potential memory injection attempts on Linux systems via an SSH session. It specifically looks for the strings "/proc/" and "/mem" within TCP traffic directed to an SSH server ($HOME_NET 22). This combination of strings suggests an attempt to access or manipulate process memory, which is a common technique used by attackers for privilege escalation or code injection.
This rule catches a preinstall script running an obfuscated index.js before the main install completes. Preinstall runs automatically without user consent. Never ignore preinstall additions in dependency updates. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects instances where an executable is deleted immediately after execution, a common defense evasion technique used by memory-resident malware like the JDY botnet. This rule specifically looks for shell processes executing 'chmod +x' or 'chmod 777' followed by 'rm' commands, often chained with '&&', ';', or '||', indicating immediate self-deletion after execution.
This rule detects attempts to disable the Linux Auditd service via a remote SSH connection. It specifically looks for the string "systemctl stop auditd" within TCP traffic destined for port 22 (SSH). Disabling auditd can be an attempt by an attacker to evade detection by removing system auditing capabilities.
This rule detects attempts to clear syslog files by looking for the command 'truncate -s 0' followed by 'syslog' within an SSH session. This activity is often associated with an attacker trying to remove evidence of their presence on a compromised system.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects web-based access to log files indicating log tampering attempts
Detects dynamic domain resolution patterns used for C2 infrastructure rotation
Detects deployment of privileged Docker containers that may allow container escape
Page 266 of 347