Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,144 detections
Filters
Last updated
All Time
Detection languages
3,228
1,086
498
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,979
2,473
1,063
1,026
910
Platforms
39,802
7,144
6,519
3,861
3,601
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,231
1,319
1,319
876
873
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the installation of specific Python packages (requests, paramiko, beautifulsoup4) combined with potential system-breaking flags, indicating the preparation phase for C0XMO's standalone lateral movement scanner.
This rule detects devices making a high volume of outbound network connections (more than 1000 connections within a one-minute window) to a single remote IP address. This behavior could indicate a network denial-of-service (DoS) attack originating from the device, or potentially other forms of high-volume network activity such as data exfiltration or scanning.
Detects processes launched with LD_AUDIT or LD_DEBUG style dynamic linker instrumentation, sometimes used to weaken execution guardrails or enable stealthy code paths.
AppArmor Profile Removed
Cortex XDR
This rule detects attempts to remove AppArmor profiles. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
Detects instances where the 'killall' command is used to forcefully terminate Google Chrome processes. This activity can be indicative of malware attempting to disrupt browser activity, potentially to prevent detection, interfere with user sessions, or facilitate other malicious actions. Specifically, this behavior has been associated with the FlutterShell backdoor.
Detects ELF binaries with suspicious capabilities for privilege escalation, such as shell execution and process capabilities
Detects modified PAM modules or ELF files implementing PAM backdoors for credential interception, as seen in Ebury and QLNX, whihc uses Rootkit techniques.
Detects the execution of hidden payloads within temporary or shared memory directories (/tmp, /var/tmp, /dev/shm). This behavior is commonly associated with the C0XMO Gafgyt botnet variant, which copies itself to these hidden '.sys' files to maintain persistence and evade detection.
Detects the use of sed commands to delete specific competitor botnet entries (e.g., mirai, gafgyt) from system persistence files like crontab or rc.local, a key defense evasion and competitor killing tactic of C0XMO.
Identifies processes launched with the __DAEMONIZED=1 environment variable. This specific marker is used by the vpmdhaj malicious npm packages to spawn their stage-2 credential harvesting payload as a detached process, allowing it to survive parent termination.
Detects an NGINX worker process spawning a shell or interpreter process, the post-exploitation primitive for CVE-2026-42945 (NGINX Rift). The exploit chain corrupts the ngx_pool_t cleanup handler and triggers system() with attacker-controlled shell commands, causing the nginx worker to fork /bin/sh with the -c flag. Since system() always invokes /bin/sh -c, the highest-fidelity match is nginx → /bin/sh -c <command>. Generalizes to catch arbitrary interpreter spawning (bash, python, perl, ruby, netcat variants, socat) which would result from any future post-exploitation pivot. Scoped to Linux because the exploit relies on the fork-based multi-worker architecture (Linux/BSD only). Windows nginx is not affected by the heap feng shui exploitation primitive.
Identifies Node.js processes downloading the Bun runtime from GitHub Releases. This behavior was observed in the vpmdhaj npm supply chain attack, where Gen-2 stagers silently downloaded Bun to execute bundled credential harvesting payloads without an immediate C2 payload drop.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
KQL Query
Identifies the creation of a stage-2 binary named 'payload.bin' within a 'node_modules' directory. This artifact is dropped by the Gen-1 stager used in the vpmdhaj malicious npm campaign, which targets cloud and CI/CD credentials.
Detects outbound network connections from web server processes to steamcommunity.com, which is used by this malware to fetch steganographically encoded C2 payloads from profile comments.
Identifies the use of curl to send POST requests to the Kubernetes API targeting the creation of pods. This can indicate an attacker using a stolen ServiceAccount token to deploy malicious or privileged containers.
Identifies the use of the nsenter utility targeting PID 1 to spawn a shell. This is a common container escape technique used to break out of a privileged container and execute commands on the underlying host.
Detects the execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets). The rule specifically looks for process creation events involving npm, node, or yarn, and then filters for command lines containing specific malicious package names identified in threat intelligence.
Detects chmod usage that sets SUID or SGID bits, which can be abused for privilege escalation.
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Page 271 of 341