Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,518
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the execution of specific Node.js scripts associated with the StegaBin package campaign. It looks for 'node.exe' or 'node' processes executing command lines containing 'scripts/test/install.js' or 'vendor/scrypt-js/version.js'. The intent is to identify the initial phase of a malicious package installation chain, which could lead to further compromise.
Detects suspicious cron job executions or the execution of a potentially trojanized 'crontab' binary. Adversaries, as seen with malware like Perfctl, may replace or modify the 'crontab' utility to hide malicious scheduled tasks from administrators. This detection looks for common patterns of malicious cron jobs.
Linux VNC Install
Sigma
Detects VNC-based lateral movement activities. Looking for the initial install
Detects the "EtherHiding" technique used by the FakeGit campaign. The malware queries a Polygon Mainnet smart contract via a public RPC node to resolve its current C2 server address. This rule looks for network connections to known blockchain RPC providers containing the specific function selectors used by the malware's V1 and V2 contracts.
Detects trojanized cron binaries that hide malicious cron jobs, with indicators resembling Perfctl
Detects CL-UNK-1068's custom-compiled Fast Reverse Proxy (FRP) variant based on unique command-line artifacts.
Detects the creation or modification of udev rules that execute suspicious commands or scripts from unusual locations. Udev rules are used by the Linux kernel device manager to handle hardware events and can be abused for persistence.
Detects abuse of package manager hooks for persistence, by hijacking the package manager execution flow
This rule detects command-line access to cloud metadata services from utilities such as curl, wget, busybox, or python. It specifically looks for command lines containing IP addresses or hostnames commonly associated with cloud metadata endpoints (e.g., 169.254.169.254, metadata.google.internal, 100.100.100.200) or metadata paths (e.g., /latest/meta-data, /computeMetadata/v1/). This is a hunting rule designed to identify unusual process activity that might indicate a cloud-aware malware framework attempting to discover cloud environment details.
Detects scripts designed for container escape and host persistence
Detects usage udev rules launching at jobs or cron jobs for persistence
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
This rule detects the execution of ELF binaries from user-writable directories within the home folder, specifically targeting paths containing '/.local/bin/'. It aims to identify potentially malicious programs, such as clipboard hijackers, that are dropped and launched by a user. The rule filters out common packaging paths like '/snap/' and '/flatpak/' to reduce false positives.
This rule detects trojanized Linux binaries, specifically targeting those that resemble Kaiji malware. The combination of these strings suggests a malicious binary with persistence and potential crypto-mining capabilities.
Detects malicious udev rules for persistence
Detects VNC-based lateral movement activities. East to West traffic
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Detects VNC-based activities. Looking for specific VNC processes
Detects a process running with a name that mimics a Linux kernel worker thread (e.g., 'kworker/...') but is not running as the root user. This is a known masquerading technique used by malware such as ClipXDaemon to evade detection.
Detects the modification of the .profile file to establish persistence, a technique used by the ClipXDaemon malware. The rule looks for a command that appends the execution of a file from the `~/.local/bin` directory to the `.profile` file.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
Page 289 of 341