Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,144 detections
Filters
Last updated
All Time
Detection languages
3,228
1,086
498
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,979
2,473
1,063
1,026
910
Platforms
39,802
7,144
6,519
3,861
3,601
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,231
1,319
1,319
876
873
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects Python processes attempting to read process memory (/proc/*/mem) or using a specific shell pipeline to scrape GitHub Actions Runner memory for masked secrets, as observed in the Mini Shai-Hulud supply chain attack.
This rule detects a potential privilege escalation attempt on Linux systems. It looks for two main indicators: first, the execution of the 'su' command from a user's home directory by a process whose executable was recently created in a user's home directory and identified as an ELF binary. Second, it identifies systems where public-facing network connections were made by processes using common remote file transfer utilities (curl, wget, lftp, axel, aria2, scp, rsync, ftp) to fetch code, followed by the execution of a process with 'algif-aead' in its command line, which could indicate fileless execution after remote code fetching. The combination suggests an attacker might be fetching malicious code, potentially compiling it, and then using it to escalate privileges via 'su' or executing it filelessly.
Detects the creation of files indicative of the compromised Checkmarx AST plugin version 2026.5.09 being deployed. This rule identifies specific malicious filenames or known compromised SHA256 hashes associated with the TeamPCP backdoor.
Linux Pam Modification
YARA-L
Detects modifications to Linux PAM configuration files or module directories, potentially indicating PAM backdoor installation such as PamDOORa. Assigns higher risk for unusual processes or multiple file modifications.
https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/
Linux Interpreter with Command Execution
Cortex XDR
Detects the execution of PHP, Perl, or Ruby script interpreters on Linux systems when they are invoked with command-line arguments that suggest direct execution of code, especially when combined with commands or functions commonly used for remote code execution or data exfiltration. This rule aims to identify potential web shell activity or other forms of arbitrary command execution.
Detects the execution of the public Dirty Frag exploit tool by monitoring for its hardcoded command-line arguments (--force-esp, --force-rxrpc). This vulnerability allows local attackers to gain root privileges via page-cache tampering in the Linux kernel without race conditions.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints, indicative of credential harvesting.
This rule detects potential log tampering activities on Linux systems followed by service manipulation within a 20-minute window on the same host.
Detects potential user namespace manipulation, a common precursor to kernel namespace exploits like Dirty Frag, by monitoring file modifications to uid_map and gid_map.
Query looks for non-root users launching the switch user (su) process via a parent process other than the normally expected processes such as shells, sudo, or su itself.
Detects the creation of specific file names associated with EarthWorm and ReverseSocks5 tunneling tools in common temporary directories (/tmp/ and /var/tmp/) on Linux systems. These tools are often used for command and control and data exfiltration.
Detects the creation of specific file names associated with EarthWorm and ReverseSocks5 tunneling tools in common temporary directories (/tmp/ and /var/tmp/) on Linux systems. These tools are often used for command and control and data exfiltration.
Detects the addition of malicious RxRPC v1 tokens to the process keyring. This behavior is indicative of the RxRPC variant of the Dirty Frag Linux local privilege escalation exploit. The exploit uses the add_key syscall to plant a session key used for in-place pcbc(fcrypt) decryption, targeting privileged files like /etc/passwd.
Query looks for potential CopyFail proof of concept (POC) code execution via identifying potentially correlated curl and su process executions. May identify false positives, yet works well for identification of CopyFail POC provided by Xint.Code.
Page 273 of 341