Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects a node.js process spawning another node.js process to evaluate a script from the command line or stdin. This is a key technique used by malware, as referenced in the Jamf Threat Labs report on DPRK-linked actors, to execute additional payloads received from a C2 server persistently.
Detects creation or modification of a systemd service file referencing xapt or related artefacts,
consistent with reported GRIDTIDE Linux persistence patterns.
consistent with reported GRIDTIDE Linux persistence patterns.
This rule detects the installation or execution of known malicious, typosquatted npm packages associated with the SANDWORM_MODE campaign. It identifies process creation events related to common Node.js package managers (npm, yarn, npx) and checks for command lines indicating package installation or execution, specifically looking for the presence of malicious package names from the SANDWORM_MODE campaign.
Detects DKnife text markers and config file names referenced by Cisco Talos (dkimsi tag, default IMSI, credential tag, and common DKnife config artefact names).
This rule detects activities associated with UNC6201 exploitation of Dell RecoverPoint VM, specifically looking for three distinct phases: Tomcat Manager WAR file deployment, modification of a persistence script on Linux, and communication with a GRIMBOLT C2 endpoint. The first part identifies WAR file deployments via Tomcat Manager. The second part looks for modifications to a specific persistence script file. The third part identifies network connections to a known GRIMBOLT C2 IP address or URL pattern.
Detects the creation of configuration files (.cfg) in sensitive or temporary Linux directories. This behavior is associated with the GRIDTIDE backdoor, which stages a configuration file containing a key to decrypt its C2 settings.
Detects execution of processes with filenames referenced in GRIDTIDE reporting, such as xapt and related components.
This rule helps you find files that may be connected to RESURGE activity affecting Ivanti Connect Secure devices, based on information shared by CISA. It can match in two ways: either the file has an exact fingerprint that CISA published, or the file contains a set of distinctive text clues that CISA included as part of its investigation material. A match should be treated as a strong lead that the device deserves immediate attention. First, confirm the match happened on an Ivanti appliance and not on a security tool repository or a harmless copy of the report. If it is on a live system, limit the device’s exposure, save copies of the matched files, and collect logs so you can understand when the change occurred and what else happened nearby. Use the result to prioritize triage and to guide deeper review of related files and activity on the same host.
This rule detects various indicators associated with the SSHStalker botnet on Linux systems, including outbound IRC-like network connections, modifications to cron files for persistence, log tampering (specifically utmp/wtmp/lastlog files), and the execution of compilers from suspicious directories like /tmp or /dev/shm. Each section of the rule targets a specific behavior of the botnet.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
This rule detects activities related to the DKnife gateway, which is associated with Adversary-in-the-Middle (AitM) attacks. It identifies the creation of specific DKnife process names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin), file events involving DKnife configuration artifacts (rules.conf, sslmm.cfg, url.cfg), and the presence of specific marker strings ("dkimsi=", "460110672021628", "PASSWORD") in logs or captured payloads. The rule aims to identify the presence and activity of DKnife components on Linux systems.
Detects suspicious modification of AI assistant configuration files potentially related to MCP server injection.
This rule detects the presence of specific file hashes associated with the RESURGE malware, which targets Ivanti Connect Secure devices, as published by CISA in AR25-087A. A match indicates a high probability of compromise on an Ivanti Connect Secure appliance.
Detection attempts to modify package manager configurations to point to potentially malicious repositories, enabling supply chain attacks through dependency confusion.
This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.
This rule detects the execution of multiple common network discovery commands within a short time frame. This behavior can indicate reconnaissance activities aimed at understanding network topology, identifying active hosts, and discovering network services.
This rule detects network connections or DNS queries to a list of domains identified as phishing campaign infrastructure. These domains are associated with a 'Signal Phishing Campaign' and are likely used for malicious purposes such as credential harvesting or malware distribution. The rule checks for these domains in `RemoteUrl` or `DestinationHost` fields across various network-related logs.
This rule detects the use of the malicious GitHub Action 'ci-quality/code-quality-check@v1' associated with the SANDWORM_MODE campaign. This action is designed to harvest CI secrets and propagate the malware by being referenced in a GitHub workflow file. The rule searches for the specific string of the malicious GitHub action within file content or file/audit paths, specifically targeting GitHub workflow files (.yml or .yaml) in '.github/workflows/' directories.
This rule detects the behavioral pattern of the dYdX RAT, which executes Python scripts from temporary directories with suppressed output. It looks for Python processes (identified by original filename) executing from common temporary directories while also suppressing output (e.g., redirecting to /dev/null or using CREATE_NO_WINDOW).
Hunts for modifications to RC initialization scripts. This could point to persistence
This rule detects the presence of environment variables used to control the malicious SANDWORM_MODE payload in CI environments or on local systems. The presence of these variables in a process command line is a strong indicator of an active infection or a workflow being manipulated by the malware's control logic.
Page 293 of 341