Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
UFW Disable Attempt
Sigma
Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects Bun or Node.js processes spawned from temporary directories making requests
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
Detects process execution containing the __DAEMONIZED=1 environment variable, which is used by the Shai-Hulud npm worm to detach from the parent process and run in the background.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
Detects the execution of the 'tee' command via sudo, potentially indicating local privilege escalation. This activity has been observed in VerdantBamboo campaigns exploiting a sudo misconfiguration for the 'egnyteservice' account on Egnyte Storage Sync systems.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects the execution of the Shai-Hulud malware's dead-man switch mechanism, specifically the 'gh-token-monitor' service or its destructive wipe payload 'rm -rf ~/'.
This rule detects the creation of an XDG Autostart entry on a Linux host by looking for network traffic containing the string "/etc/xdg/autostart/" in a TCP flow to the server on port 22. This directory is commonly used for persistence by malware to automatically execute at system startup.
This rule detects network traffic containing the string "/etc/udev/rules.d/" over TCP port 22 (SSH). This string is indicative of an attempt to modify udev rules, which can be used for Linux persistence by executing malicious scripts or commands when specific hardware events occur. The detection is focused on traffic flowing from the home network to a server on the home network, suggesting an internal system attempting to modify udev rules on another internal system via SSH.
Detects the execution of the 'MicrosoftSystem64' RAT binary across Windows, macOS, and Linux operating systems. This specific malware is associated with the FAMOUS CHOLLIMA threat group, which is linked to DPRK, and is known to deploy a Node.js SEA RAT that exfiltrates data to HuggingFace.
Sudo Caching and Elevation Abuse
Gravwell
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
GitHub CLI Token Extraction
Cortex XDR
Detects the execution of `gh auth token` which is used by the Shai-Hulud malware to steal the active GitHub Personal Access Token (PAT). This rule specifically looks for the `gh.exe` or `gh` process executing with command-line arguments containing both "auth" and "token".
Detects file write operations to '/mnt/runner' indicating a sudoers configuration modification. This technique is utilized by the Miasma npm malware to grant passwordless sudo access for privilege escalation on GitHub Actions CI/CD runners.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Page 269 of 340