Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,144 detections
Filters
Last updated
All Time
Detection languages
3,228
1,086
498
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,979
2,473
1,063
1,026
910
Platforms
39,802
7,144
6,519
3,861
3,601
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,231
1,319
1,319
876
873
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This detection identifies the use of the chattr command on Linux endpoints to add or remove the immutable (+i/-i) attribute on files. Threat actors abuse this technique to protect malicious files (such as persistence mechanisms or web shells) from modification or deletion, or to remove immutability from system files prior to tampering. Investigate the parent process, executing user, and target file path to determine whether the activity aligns with legitimate administrative work or indicates anti-forensics or persistence behavior.
Detects modifications to /home/vmanage-admin/.ssh/authorized_keys on Cisco SD-WAN controllers (vSmart, vManage, vBond) by any process. This file is a post-exploitation persistence target documented by Resecurity and Rapid7 for CVE-2026-20182. Legitimate modifications to this file are extremely rare in production SD-WAN deployments, as the vmanage-admin account is an internal service account and its authorized_keys file is provisioned during initial deployment and rarely touched afterward. Any write event is worth immediate investigation.
Detects processes utilizing ${IFS} in conjunction with Base64 decoding. This technique is used by the Gogs argument injection exploit to bypass Git branch name space restrictions while delivering encoded shell payloads.
Docker Run/Exec Guardrails Bypass
Cortex XDR
This rule detects the execution of a Docker command with the '--privileged' flag on a Linux system, combined with the execution of specific system information gathering commands. This combination is often indicative of an attempt to escape a container or gain elevated privileges within a containerized environment, potentially leading to host compromise. The '--privileged' flag grants a container nearly all capabilities of the host machine, making it a critical security concern when used maliciously.
Linux Timestomping via Reference FIle
Cortex XDR
Detects the use of the 'touch' command on Linux with '-m' and '-r' (reference file) or '--reference' arguments. This combination can be used for timestomping, a technique to modify file timestamps to evade detection or forensic analysis by making malicious files appear to have legitimate creation/modification times.
Detects `git rebase` commands containing the `--exec=` flag when spawned by a Gogs or Gitea server process. This activity is indicative of the exploitation of an argument injection vulnerability (CVE-2022-46153) in Gogs/Gitea, which allows an authenticated user to achieve Remote Code Execution (RCE) by creating a pull request with a specially crafted branch name. The rule specifically looks for `git` or `git.exe` processes executing `rebase` with `--exec=` and originating from `gogs`, `gitea`, or common shell processes that might be spawned by them.
Linux SELinux Setenforce
Cortex XDR
Detects attempts to disable SELinux by executing the 'setenforce 0' command on Linux systems. Disabling SELinux can reduce the security posture of a system and is often performed by attackers to bypass security controls.
Detects the loading of kernel modules using insmod. Executing this from within a container or unexpected context often indicates abuse of CAP_SYS_MODULE to load malicious rootkits or reverse shells for privilege escalation or container escape.
Detects git rebase commands containing the `--exec=` flag, which is indicative of the argument injection vulnerability used to achieve RCE in Gogs. This rule specifically looks for the execution of 'git' or 'git.exe' with 'rebase' and '--exec=' in the command line.
Awk System Execution
Cortex XDR
This rule detects the execution of 'awk' on Linux systems when its command line contains includes suspicious functions like. This pattern is often indicativeof malicious script execution or command injection attempts using awk.
Phantom Bot Systemd Service Persistence
Cortex XDR
Detects Linux persistence mechanisms specifically associated with the creation or execution of the 'phantom-bot.service' systemd service, used by the axois-utils phantom bot to execute DDoS attacks. The rule looks for process creation events on Linux where the command line contains 'phantom-bot.service' and the process name is 'sh', 'bash', 'systemctl', or 'node'.
Node.js Accessing Developer Secrets
Cortex XDR
Detects Node.js processes rapidly reading multiple sensitive developer configuration or credential files (e.g., .env, AWS credentials, SSH keys) within a short timeframe. This behavior is indicative of infostealer activity, often observed with malicious npm packages.
Detects make explicitly loading a Makefile from temporary or non-standard locations, often used to run arbitrary commands (due to writeable capability) via a trusted build utility.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects mount(8) bind operations from writable temp directories onto sensitive system subtrees, sometimes used to bypass integrity expectations or overlay binaries.
Detects the execution of the public Proof-of-Concept for the "Dirty Frag" Linux Kernel Privilege Escalation vulnerability. It monitors for the specific command-line flags '--force-esp' and '--force-rxrpc', as well as the execution of /bin/sh or /bin/bash with the TERM=xterm environment variable, which is indicative of the PoC's payload.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints,
indicative of credential harvesting by the Mini Shai-Hulud malware.
indicative of credential harvesting by the Mini Shai-Hulud malware.
Detects dnsmasq or its DHCP helper child process terminating abnormally on Linux hosts due to signals like SIGSEGV, SIGABRT, SIGBUS, or SIGILL. This behavior is indicative of a crash, potentially caused by exploitation attempts of vulnerabilities such as CVE-2026-4892, a heap buffer overflow in dnsmasq's helper.c when processing oversized DHCPv6 Client Identifier (CLID) options. This rule fires post-impact, complementing network-side detections.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Page 272 of 341