Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects processes making network requests to the '/api/css.js' endpoint, which is indicative of the ErrTraffic malware.
This rule detects attempts to grep for passwords within the bash history file over an SSH connection. Specifically, it looks for the string 'grep -i password ~/.bash_history' in TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker attempting to discover credentials on a compromised system.
This rule detects the spawning of a root shell from specific SUID binaries (su, sudo, doas, passwd, chsh) when the initiating process was run by an unprivileged user. This behavior is indicative of a privilege escalation exploit, potentially related to CVE-2026-45257 (BUMSRAKETE).
This rule detects the delivery of a Linux ptrace injection tool via HTTP. It specifically looks for the string "ptrace(PTRACE_ATTACH" within HTTP response data, indicating that a file containing this specific ptrace function call is being sent to a client. This technique is often used for process injection and privilege escalation on Linux systems.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
This rule watches for Node or similar runtimes scanning cloud secret stores after installing a dependency. Stolen secrets can lead to full cloud account takeover. Validate the package against your software bill of materials. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule looks for a package writing a short-lived JavaScript file with a p-prefix name in temp during install. That pattern matches known stealers and wipers. Quarantine the package version. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
This rule detects network traffic that contains specific strings indicative of a Systemd service unit being created for persistence. Specifically, it looks for the string "/etc/systemd/system" and ".service" within TCP traffic directed to the home network on port 22 (SSH). This combination suggests an attempt to establish persistence on a Linux system by creating a new Systemd service.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
This rule detects the string "systemctl enable" within TCP traffic on port 22 (SSH). This indicates an attempt to enable a systemd service on a remote Linux host via an established SSH connection. This activity could be part of legitimate system administration but also could be indicative of an attacker persisting a malicious service.
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Detects upload of malicious modules to web server application directories
Detects C2 commands triggering disk wipe operations for destructive impact
Detects SSH connections between internal hosts indicating lateral movement
Detects raw disk volume access used to bypass file system security controls
Detects systemctl used to enable or start services for Linux execution
Detects creation of archives for staging collected data before exfiltration
Detects LD_PRELOAD environment variable set to load malicious shared libraries
This rule detects potential data exfiltration or unauthorized copying of data from USB drives via an SSH SCP session. It specifically looks for TCP traffic on port 22 (SSH) within the home network, where the data flow is from the client to the server (upload). The rule triggers if the content of the SCP session includes both "/media/" and "/usb" (case-insensitive), indicating paths commonly associated with mounted USB devices on Linux systems, and the data size is greater than 1000 bytes. This suggests that contents from a USB drive are being copied off the system over SSH.
Page 268 of 347