Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects inbound SSH connections originating from external IP addresses to systems running SSH services. It specifically looks for successful incoming network connections where the destination port is commonly associated with SSH (22, 222, 2222, 8022) or the source process name is an SSH daemon (sshd, dropbear). The rule explicitly excludes connections from private IP ranges and certain common web server processes on standard web ports to reduce false positives. The threat model includes unauthorized external SSH access, brute-force/credential-stuffing attacks, backdoor SSH daemons, compromised servers accepting attacker sessions, and reverse shell callbacks.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
This rule set looks for signs linked to the Shadow Campaigns espionage group. It flags the use of their loader, checks for connections to known servers they have used, spots fake security software used as bait, and highlights suspicious activity coming from web server processes that may indicate a hidden backdoor.
This rule detects the execution of bash or sh scripts that contain specific keywords associated with the OpenClaw installation process. It looks for command lines that include "openclaw" along with other distinctive strings such as "run_remote_bash", "OPENCLAW_INSTALL_SH_NO_RUN", "OPENCLAW_USE_GUM", "All your chats, one OpenClaw", ".openclaw/openclaw.json", or "openclaw.ai/install.sh". This aims to identify potential OpenClaw installation attempts, even if the script itself has been renamed.
Detects command injection related attacks with AI agents through suspicious prompt patterns or system command execution by AI processes.
This rule detects outbound SSH (Secure Shell) connections initiated by common SSH client executables (ssh.exe, ssh, plink.exe, dbclient.exe) to external IP addresses. It explicitly excludes connections to common private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the loopback address (127.0.0.0/8) to reduce false positives from internal network activity.
Detects suspicious web requests to the Tomcat Manager on Dell RecoverPoint appliances. This technique is used by UNC6201 to exploit CVE-2026-22769 and upload malicious WAR files.
Detects the creation of JSP web shells or suspicious CSS files in the specific directory used by Ivanti EPMM for application distribution, a common post-exploitation step observed in this campaign.
Detects suspicious child processes (e.g., shells, network utilities) spawned by the Ivanti EPMM web server process (java, tomcat, httpd). This behavior is a strong indicator of successful remote code execution, often following the exploitation of vulnerabilities like CVE-2026-1281 and CVE-2026-1340.
This detection identifies modifications to the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This script is executed at boot time and was observed being modified by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.
This rule detects suspicious Python command-line executions that involve importing the 'requests' library, using 'exec()' for dynamic code execution, and making HTTP/HTTPS requests. This pattern is often observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects modification of the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This technique is used by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.
The following rule detects attempts to tamper with Linux log records by looking for interpreter processes, or common utility commands interacting with critical log files such as /var/log/wtmp, /var/log/btmp, or /var/run/utmp. It also includes scenarios where 'dd' or 'cp' might be used with /dev/null or /dev/zero to effectively clear or overwrite log content.
This rule detects Python scripts that use base64 decoding and execution, specifically looking for the 'import base64' statement appearing early in the file, followed by 'exec(base64.b64decode(' and ').decode('utf-8'))'. This pattern is indicative of a common method for obfuscating and executing malicious Python payloads, often seen in malware like KongTuke.
This detection identifies the execution of iptables commands used to implement Single Packet Authorization (SPA). This technique was observed being used by UNC6201 on compromised VMware appliances to create stealthy, conditional network proxies for C2 traffic. The rule looks for specific command-line arguments indicative of SPA setup, including rules for 'magic packet' detection, dynamic IP list management using the 'recent' module, and traffic redirection.
Sleeper-style JSP backdoor: 403.jsp or similar with Runtime.getRuntime().exec or ProcessBuilder
This rule set detects attempts to download an 'install.sh' script from the domains 'clawd.bot' or 'openclaw.ai' using various methods. The first rule, 'openclaw_curl_install_script', specifically targets command-line tools like curl, wget, aria2c, and fetch. The 'openclaw_powershell_download' rule focuses on PowerShell commands (Invoke-WebRequest, iwr, Invoke-RestMethod, irm) used for downloading. The 'openclaw_aria2c_fetch_download' rule is redundant with the first rule, as it also targets aria2c and fetch. The 'openclaw_lolbin_download' rule identifies the use of Living Off The Land Binaries (LOLBins) such as certutil, bitsadmin, and mshta for the same download activity. Finally, the 'openclaw_http_install_sh' rule detects direct HTTP network requests to the 'install.sh' path on these domains. Collectively, these rules aim to identify potential initial access or execution attempts involving a suspicious installation script from specific domains.
This rule detects the execution of a bash or sh script that contains multiple identifiers related to OpenClaw installation. It specifically looks for command lines ending with '/bash' or '/sh' and containing 'openclaw', combined with additional OpenClaw-specific strings such as 'run_remote_bash', 'OPENCLAW_INSTALL_SH_NO_RUN', 'OPENCLAW_USE_GUM', 'All your chats, one OpenClaw', '.openclaw/openclaw.json', or 'openclaw.ai/install.sh'. This content-based detection aims to identify OpenClaw install script execution even if the script is renamed.
Detects the execution of iptables commands used for Single Packet Authorization (SPA), a technique observed being used by UNC6201. This rule identifies when iptables is configured to inspect traffic on port 443 for a specific hex string, which is a key component of the actor's C2 proxying tradecraft.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Page 295 of 341