Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects instances where an npm or node process spawns a shell, which in turn executes a command-line networking utility like curl or wget. This behavior is indicative of a malicious pre/post-install script used in supply chain attacks, such as the one seen with the 'ambar-src' package.
Detects a Node.js process spawning a Python windowless interpreter (pythonw.exe) from a temporary directory. This unusual process chain is a key indicator of the 'Contagious Interview' infection chain, where a portable Python runtime is dropped and executed.
Detects two persistence techniques used by EncystPHP: the creation of backdoored root-level accounts and the injection of SSH keys into user accounts. Specifically, it looks for 'useradd' commands creating accounts with UID 0 and specific generic usernames, and modifications to '.ssh/authorized_keys' files by non-root/non-sshd processes.
Detects the execution of iptables to set the default policy for a chain (INPUT, OUTPUT, or FORWARD) to ACCEPT. This technique was used by a stager in a campaign delivering the Rekoobe backdoor to weaken the host's firewall posture and ensure C2 communication.
Detects processes on Linux systems that exhibit fileless execution characteristics while masquerading as common shells or interpreters. This behavior is a key TTP of the ShadowHS post-exploitation framework, which uses argv spoofing and in-memory execution to evade detection.
Detects Linux cron persistence, log tampering, outbound IRC ports, or compiler use from temp paths, matching SSHStalker botnet tradecraft.
This rule detects modifications to AI assistant configuration files by suspicious processes like package managers (npm, yarn) or shell interpreters (bash, powershell). This activity is indicative of a supply chain attack, specifically the SANDWORM_MODE campaign, where an attacker injects a rogue Model Context Protocol (MCP) server entry to hijack AI tools. This enables automated source code and secret theft via prompt injection.
Detects the presence of files matching the SHA256 hashes of known RESURGE malware components, including the main 'libdsupgrade.so' library, the 'liblogblock.so' log tamperer, and the 'dsmain' utility. This rule identifies the creation or modification of these specific files on a device.
Detects a process with a short, alphanumeric filename executing from the /var/tmp/ directory and spawning a shell. This behavior is associated with the GRIDTIDE backdoor, which uses this technique for post-compromise reconnaissance and execution.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
Detects attempts to disable or stop the 'auditd' service on Linux systems using common service management utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses and avoid logging of their malicious actions.
This rule detects activity related to the DKnife gateway AitM (Adversary-in-the-Middle) threat, as detailed in Talos Intelligence reporting. It identifies specific binary names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin) associated with the threat, either as process names or file names. Additionally, it looks for configuration artifacts (rules.conf, sslmm.cfg, url.cfg) used by the proxy/redirect logic, either as file names or within process command lines. Finally, the rule identifies exfiltration or tagging markers (dkimsi=, 460110672021628, PASSWORD) observed in logs or artifacts, which are indicative of DKnife's reporting mechanisms.
This rule helps you find files that may be connected to RESURGE activity affecting Ivanti Connect Secure devices, based on information shared by CISA. It can match in two ways: either the file has an exact fingerprint that CISA published, or the file contains a set of distinctive text clues that CISA included as part of its investigation material. A match should be treated as a strong lead that the device deserves immediate attention. First, confirm the match happened on an Ivanti appliance and not on a security tool repository or a harmless copy of the report. If it is on a live system, limit the device’s exposure, save copies of the matched files, and collect logs so you can understand when the change occurred and what else happened nearby. Use the result to prioritize triage and to guide deeper review of related files and activity on the same host.
Detects the execution of specific Asterisk CLI commands, often associated with reconnaissance or resource hijacking, by non-interactive or web server accounts. This behavior is a key indicator of the EncystPHP web shell abusing PBX functionality for activities like toll fraud.
Detects the creation of the covert socket file '/home/runtime/tmp/.logsrv', which is used by the RESURGE malware as a communication bridge between its hooked 'web' process and its 'dsmdm' SSH component on Ivanti Connect Secure devices.
This rule detects network connections to known cryptocurrency mining pools or processes associated with cryptocurrency mining. It identifies suspicious activity based on remote URLs, process names, and remote ports commonly used by miners.
This rule detects activities associated with the SSHStalker botnet. It identifies outbound IRC-like network traffic on common IRC ports (6667, 6697, 7000) over TCP. It also looks for persistence mechanisms by monitoring writes to common cron job directories and files on Linux systems. Additionally, the rule detects log tampering attempts by monitoring writes to critical system log files such as /var/run/utmp, /var/log/wtmp, and /var/log/lastlog. Finally, it identifies on-host compilation activities, specifically the execution of compilers (gcc, cc, clang) or build tools (make) within suspicious temporary directories like /tmp, /var/tmp, or /dev/shm, which can indicate malware compilation.
Detects suspected DKnife gateway AitM activity by matching Linux process/file artifacts (component names and config files) described in the Talos DKnife disclosure.
Detects the Claude CLI or Claude Code spawning suspicious child processes such as shells or network utilities. This behavior indicates exploitation of malicious hooks or MCP server configurations executing arbitrary commands, as seen in CVE-2025-59536 and CVE-2026-21852.
Detects attempts to execute the 'dsmain' utility with specific flags (-e, -d, -g) used by RESURGE for AES encryption/decryption of the coreboot RAM disk or to extract the vmlinux kernel image on Ivanti Connect Secure devices.
Page 292 of 341