Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
High-fidelity correlation of OS-DET-LNX-005 and OS-DET-LNX-006: a system shell copied to a
non-standard/writable path, followed within 15 minutes on the same host by execution of a
shell with the privilege-preserving -p flag from a non-standard path. The two events
together are a near-certain SUID-root shell misconfiguration abuse (bash -p to root) and a
lower-FP signal than either component alone. Detection logic adapted from Elastic Security Labs.
non-standard/writable path, followed within 15 minutes on the same host by execution of a
shell with the privilege-preserving -p flag from a non-standard path. The two events
together are a near-certain SUID-root shell misconfiguration abuse (bash -p to root) and a
lower-FP signal than either component alone. Detection logic adapted from Elastic Security Labs.
This rule identifies Linux-based devices that are vulnerable to specific security flaws tracked under CVE-2026-64507 and CVE-2026-64508. It correlates vulnerability assessment data with device inventory to highlight exposed systems.
Detects instances where the Ivanti Sentry service process spawns suspicious child processes (shells, network utilities, or interpreters) while running with root privileges. This behavior is indicative of exploitation of CVE-2026-10520, an OS command injection vulnerability in Ivanti Sentry that enables unauthenticated remote code execution with root permissions.
This rule detects potentially malicious command execution patterns in Linux environments, specifically targeting Node.js processes performing in-memory evaluation of code (often associated with fileless loaders) or the downloading of files with the .enc extension using common utilities like curl or wget, which may indicate C2 payload retrieval.
Detects potential misuse of SSH credentials by identifying successful SSH logins from source IP addresses that have not been observed in the previous 14 days, or successful SSH logins occurring within one hour of an authorized_keys file modification on the same host. This combination of behaviors is indicative of an adversary establishing or using persistence via SSH key manipulation.
Detects various techniques used to escape from Linux container isolation, including accessing container daemon control sockets (Docker/containerd), abusing namespace operations (nsenter/setns), mounting sensitive host filesystem paths (e.g., /proc/1/root), performing chroot escapes, and abusing privileged capabilities or socket-based execution.
Detects incoming HTTP POST requests to the 'diffpatch' endpoint in Gitea that contain suspicious 'diff --git' patterns combined with path traversal sequences ('../') targeting 'hooks/' directories. This indicates an attempt to exploit CVE-2026-60004 to achieve unauthorized file system access or remote code execution via repository hooks.
Detects attempts to exploit a vulnerability (CVE-2026-68536) in the Apache MyFaces JSF resource handler. The rule monitors for malicious URI parameters ('ln' or 'library') that attempt Server-Side Request Forgery (SSRF) targeting cloud metadata services, path traversal, or URI-based injection attacks.
This rule detects attempts to exploit CVE-2026-93647, a Stored Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic Webclient. The exploit involves injecting malicious script tags or JavaScript event handlers into calendar fields such as SUMMARY, DESCRIPTION, or LOCATION. The detection monitors inbound TCP traffic on web ports used by the application, specifically looking for common XSS injection patterns within calendar-related fields.
Detects unauthenticated network requests targeting MLflow Model Registry and Ajax API endpoints on port 5000. These requests are characteristic of unauthorized reconnaissance against exposed machine learning management services.
The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port.
It leverages Cisco Network Visibility Module flow data logs to identify potentially suspicious behavior by looking at processes
communicating over ports like 4444, 2222, or 51820 are commonly used by tools like Metasploit, SliverC2 or other pentest, red team or malware.
These connections are worth investigating further, especially when initiated by unexpected or non-network-native binaries.
It leverages Cisco Network Visibility Module flow data logs to identify potentially suspicious behavior by looking at processes
communicating over ports like 4444, 2222, or 51820 are commonly used by tools like Metasploit, SliverC2 or other pentest, red team or malware.
These connections are worth investigating further, especially when initiated by unexpected or non-network-native binaries.
The following analytic identifies instances where users may have mistakenly entered their passwords in the username field during authentication attempts. It detects this by analyzing failed authentication events with usernames longer than 7 characters and high Shannon entropy, followed by a successful authentication from the same source to the same destination. This activity is significant as it can indicate potential security risks, such as password exposure. If confirmed malicious, attackers could exploit this to gain unauthorized access, leading to potential data breaches or further compromise of the system.
Detects suspicious network activity or credential exfiltration attempts occurring during package manager installation processes (npm, pip, yarn). The rule monitors for lifecycle scripts (e.g., preinstall, postinstall) spawning network utilities to external destinations or accessing common CI/CD secrets like AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects instances where common scripting engines like Python or Node.js are used to spawn command shells (CMD, PowerShell, or Bash) followed by the execution of suspicious commands commonly associated with reconnaissance, file exfiltration, or lateral movement.
Detects unauthorized modifications to the .ssh/authorized_keys file. Such changes are often performed by adversaries to establish persistence by ensuring their own public keys allow them remote access to the host. The rule filters out known configuration management and system tools to reduce noise.
This rule detects potentially malicious behavior in package manager post-install scripts (npm, pip). It monitors for child processes like shells, network utilities (curl, wget), or command-line arguments indicative of credential harvesting (e.g., accessing .ssh, .aws/credentials, environment variables) initiated by package management processes.
Detects the deployment of the Hermes Agent AI framework by the Carbonato botnet. The rule identifies the creation or modification of a 'SOUL.md' persona file within specific directories (/root/.hermes/ or /opt/netd/) followed by an outbound network connection to a known LLM gateway IP or the Telegram API. This pattern is indicative of a post-exploitation AI agent being installed for command and control or task execution.
Detects access or modification of files containing sensitive API tokens or keys (such as OpenAI, Anthropic, or Google Gemini) located within the /root/.hermes/loot/ directory. This activity is often associated with the staging of stolen credentials by automated malicious processes.
Detects evidence of cryptocurrency mining (XMRig) and suspicious process masquerading on Linux systems, alongside container-related events referencing known malicious or suspicious strings such as 'GH0ST_C2' or 'fsociety'.
Detects unauthorized file creation within the /root/.hermes/loot/ directory and specific path combinations associated with the CARBONATO botnet's Hermes Agent. This activity is indicative of credential harvesting, specifically the exfiltration of AI API keys for various LLM providers.
Page 29 of 347