Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the use of non-standard kill signals (-900, -901) used to manage the ShadowGuard eBPF rootkit's process allow-list. This activity is associated with the TGR-STA-1030 threat actor.
Detects the VoidLink malware's initial dropper behavior, where a process masquerading as a kernel thread executes a payload from memory. This is indicative of the memfd_create and execveat fileless execution technique used by VoidLink, characterized by a process created with no FolderPath or FileName, initiated by a process named like a kernel thread.
This rule set detects potential post-exploitation activity and exploitation attempts targeting Ivanti EPMM (formerly MobileIron Core). The first rule, `ivanti_epmm_java_spawns_shell`, identifies suspicious process creation where a Java or Tomcat process (parent process) spawns a shell process (cmd.exe, bash, sh, or powershell.exe). This behavior is indicative of an attacker gaining remote code execution and using the compromised Java/Tomcat process to execute system commands. The second rule, `ivanti_epmm_http_featureusage_exploit`, detects HTTP requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of Expression Language (EL) injection or format string abuse, specifically looking for `format=` along with keywords like `${`, `Runtime`, `exec`, or `getRuntime` in the URL. This suggests an attempt to exploit a vulnerability in the Ivanti EPMM application to achieve remote code execution.
Detects high-risk command execution (e.g., curl, wget, ssh) originating from AI agent runtime processes like OpenClaw/ClawdBot. This behavior is associated with threat actors using backdoored 'skills' to exfiltrate data or move laterally.
Let's create a detection rule for "XONER dropper (multi-key
download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips,
xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner
xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips,
xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner
xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
This rule detects the use of the 'chmod' command to set overly permissive file permissions, specifically '777' (read, write, and execute for all users) in either octal or symbolic notation. It looks for 'chmod' as the executed command and then checks its arguments for '777', '0777', 'a=rwx', 'ugo+rwx', or 'a+rwx'. This activity can indicate a misconfiguration, a security vulnerability being introduced, or an attempt to bypass security controls.
Detects the DKnife gateway-monitoring framework, a toolset used by China-nexus actors for adversary-in-the-middle (AitM) attacks, based on specific file, network, and persistence artifacts.
Detects the creation of files or directories containing the string 'swsecret', which is a hard-coded artifact used by the ShadowGuard eBPF rootkit for concealment.
This rule detects the creation of 'rclone.conf' file on a device. The 'rclone.conf' file is a configuration file used by the Rclone utility, a command-line program for syncing files with various cloud storage services. The presence of this file often indicates the installation or use of Rclone, which can be leveraged by adversaries for data exfiltration to cloud storage.
Detects Bash /dev/tcp with HTTP request construction - high fidelity detection for payload download via raw sockets
Detects the execution of processes named 'openclaw-agent.exe' or 'openclaw-agent'. These binaries are being distributed as malicious 'prerequisites' in weaponized OpenClaw AI agent skills to install infostealers and other malware.
The rule detects potential execution or presence of EDRKiller or similar tools by matching known malicious hashes from an external source against telemetry from Defender for Endpoint to help security analysts identify compromised endpoints, investigate delivery methods, and take remediation actions.
Detects the use of custom kill signals (-900, -901) which are used by the ShadowGuard eBPF rootkit to add or remove a process from its allow-list for kernel-level concealment.
Detects modification of core OpenClaw AI agent behavioral files (SOUL.md, AGENTS.md). Threat actors have been observed using malicious 'skills' to append instructions to these files, creating a 'cognitive rootkit' that persistently alters the agent's behavior.
Detects the creation or modification of a `.vscode/tasks.json` file that is configured to automatically run a task when a folder is opened.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Detects a process reading a .env file, which often contains sensitive credentials like API keys. This is often the first step of a data exfiltration pattern where the credentials are then sent to an attacker-controlled server. This behavior was observed in the malicious 'rankaj' OpenClaw skill. This rule should be correlated with subsequent network activity from the same process to a rare destination.
Detects the modification of a `.vscode/settings.json` file to include a `PROMPT_COMMAND`. This technique allows an attacker to execute arbitrary commands every time a new terminal is opened in a Linux-based VS Code environment, such as GitHub Codespaces. It can be used for persistence or to exfiltrate credentials and secrets.
Detects the use of non-standard signals with the 'kill' command, which are used to manage the ShadowGuard eBPF rootkit's process hiding capabilities. Signal -900 is used for allow-listing a PID, and -901 is used to remove a PID from the allow-list.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Detects the execution of automated Nginx configuration modification scripts by identifying the use of 'csplit', 'awk', or 'sed' in close proximity to Nginx service management commands (reload, restart, or testing). This pattern is a hallmark of the 'bt.sh', 'zdh.sh', and '4zdh.sh' toolkits used to inject malicious proxy_pass directives.
Page 297 of 341