Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects post-exploitation activities originating from the `telnetd` process, specifically targeting scenarios following an Inetutils Telnetd authentication bypass. It identifies three main categories of malicious activity: reconnaissance, SSH key injection for persistence, and malware deployment. Reconnaissance activities are detected by commands like `uname -a`, `id`, `cat /proc/cpuinfo`, or `cat /etc/passwd` executed via common shells (`/bin/sh`, `/bin/bash`, `/bin/ash`). SSH key injection is identified by `echo` commands attempting to write SSH public keys (e.g., `ssh-rsa`, `ssh-ed25519`) into `~/.ssh/authorized_keys` or `/root/.ssh/authorized_keys`. Malware deployment is detected by `nohup` commands executing `curl` or `wget` to download and pipe content to interpreters like `python`, `python3`, `sh`, or `bash`.
Chrysalis Backdoor SHA256 Hash Detection
Cortex XDR
This rule detects the presence or execution of the Chrysalis Backdoor by matching known SHA256 hashes of its components. It monitors file and process events for these specific hashes.
Detects execution of cryptocurrency mining software often spawned by web server processes or executed from temporary directories. This behavior is common in post-exploitation scenarios, such as those involving vulnerabilities like XWiki CVE-2025-24893, where attackers deploy miners like XMRig. Sysmon For Linux EventID 1 is the best way to detect this behavior.
Detects attempts to access the sensitive Clawdbot/Moltbot configuration file (clawdbot.json or moltbot.json). This file contains API keys and gateway tokens. Unauthorized access, often resulting from prompt injection attacks, can lead to full agent and system compromise.
Detects inbound network connections from external (non-loopback, non-private) IP addresses to ports commonly used by Clawdbot/Moltbot gateways (3000, 8080, 16007). An exposed gateway is a significant security risk that can allow unauthorized remote administrative control over the AI agent.
Detects a behavioral sequence where an AI agent runtime (e.g., Node.js, Python) spawns a shell to execute a web request utility like curl or wget. This pattern is a strong indicator of automated data exfiltration, often resulting from a successful prompt injection attack that instructs the agent to steal and send data to an attacker-controlled server.
Detects instances where an AI agent process (e.g., Moltbot, ClawdBot) performs a web search or HTTP request containing suspicious internal identifiers (like API keys or project names) as URL parameters. This behavior is a hallmark of 'search-and-leak' exfiltration tactics, often triggered by indirect prompt injection.
Detects network connections to Polygon (MATIC) blockchain RPC endpoints. The DeadLock ransomware strain has been observed using smart contracts on the Polygon network to retrieve C2 proxy server addresses, making this a key indicator of compromise.
Detects when a Visual Studio Code process spawns a shell that immediately downloads and executes a script using a tool like `curl` and pipes it to a runtime like `node`. This indicates the abuse of `tasks.json` for code execution, a technique used by DPRK-linked actors.
Detects the telnetd process spawning child processes with highly suspicious environment variables, such as a modified PATH or LD_PRELOAD. This can indicate an attempt to hijack execution or move laterally, and is a technique associated with CVE-2026-24061.
Detects the GNU telnetd service spawning the login binary with the '-f' flag, which is used to skip authentication. This is the primary indicator of the CVE-2026-24061 exploitation. This detection requires process creation logging on Linux, which can be enabled via tools like Sysmon for Linux.
Detects potential Sliver C2 implant activity on Linux systems based on process execution patterns, such as in-memory execution via memfd or process name masquerading from temporary directories.
Detects the exploitation of CVE-2026-24061, a critical authentication bypass vulnerability in GNU telnetd. The rule identifies when the 'telnetd' process spawns '/usr/bin/login' with the '-f' flag, which skips authentication and grants the attacker remote access.
Detects exploitation attempts of CVE-2025-42944, a critical insecure deserialization vulnerability in SAP NetWeaver AS Java RMI-P4 module. This rule identifies when SAP Java processes spawn system shells or execute suspicious commands, which is indicative of successful exploitation of the deserialization flaw. Attackers can exploit this vulnerability by sending malicious serialized Java objects to exposed RMI-P4 ports (typically 50004 or 50014), leading to arbitrary OS command execution with full system privileges. This pattern detects the post-exploitation behavior where the compromised Java process spawns interactive shells, creates scheduled tasks, or executes system commands.
Detects the use of GDB (GNU Debugger) to dump the memory of a running process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets from live processes without writing traditional credential dumping tools to disk.
This rule detects the specific artifacts associated with the '01flip' ransomware. It triggers when a ransom note named 'RECOVER-YOUR-FILE.TXT' is created, followed by the rapid renaming of more than 10 files on the same host with the '.01flip' extension. The correlation is based on the hostname and the process command line within a 5-minute window, indicating a coordinated ransomware attack.
This rule detects the multi-stage VoidLink C2 loader chain by identifying a combination of behaviors. It looks for fileless execution, specifically processes running from memory file descriptors or /proc/[pid]/fd paths. It also identifies kernel thread masquerading, where processes attempt to mimic legitimate kernel threads by using command lines like '[kworker/...]' or '[migration/...]' in conjunction with non-kernel executable paths. The rule further identifies staging activities, such as processes executing from common temporary directories like /tmp, /dev/shm, or /var/tmp. Additionally, it looks for specific VoidLink artifacts in command lines, including '.vl_', 'stage[0-9].bin', 'implant.bin', or C2 communication patterns like '/api/v2/(handshake|sync)'. Finally, it detects anonymous network activity, where a deleted executable (indicating fileless execution) is associated with network connection utilities like curl, wget, or socket/connect calls. The rule triggers when specific combinations of these behaviors are observed, such as fileless execution combined with kernel masquerading, or fileless execution combined with staging, or kernel masquerading combined with staging, or VoidLink artifacts combined with fileless execution or kernel masquerading, or anonymous network activity combined with kernel masquerading or staging. This correlation aims to reduce false positives by requiring multiple indicators of compromise.
Detects the execution of the 'login' process with the '-f' flag, which skips authentication. When spawned by 'telnetd', this is a strong indicator of exploitation of CVE-2026-24061, a critical authentication bypass vulnerability.
This rule detects various behaviors associated with the VoidLink threat, focusing on persistence, privilege escalation, and evasion techniques. It identifies suspicious kernel module loading from temporary directories, the presence of hidden rootkit files, container escape attempts, and cloud metadata harvesting. The rule correlates these activities to reduce false positives, specifically looking for combinations such as suspicious module loads with hidden rootkit files or container escapes, container escapes with cloud metadata harvesting, hidden rootkit files with container escapes or cloud metadata harvesting, and eBPF evasion techniques combined with suspicious module loads or hidden rootkit files. The detection logic suggests an adversary attempting to establish persistence, elevate privileges, and potentially exfiltrate cloud credentials within a Linux environment, possibly involving containerized setups.
Detects the creation or modification of a browser extension's manifest.json file configured to inject a script into the 'MAIN' world context of chatgpt.com. This technique allows the extension to bypass the isolated content script environment, hook native APIs like window.fetch, and steal session tokens, as seen in a campaign targeting ChatGPT users.
Detects the creation or modification of a browser extension's manifest.json file that overrides the default search provider to a known malicious or suspicious domain. This technique is used by extensions like 'DPS Websafe' and 'Stock Informer' for search hijacking.
Page 298 of 341