Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects various activities associated with the ShadowHS fileless Linux post-exploitation framework, including fileless execution, specific command-line patterns, covert exfiltration, and connections to known C2 infrastructure.
Detects the creation of a local user account with root privileges (UID 0) using the 'useradd' command with the non-unique flag. This technique is used by threats like EncystPHP to create stealthy administrative accounts (e.g., 'newfpbx') for persistent access.
Detects the use of 'chmod 000' on PHP files within common web root directories. This technique is used by threats like the EncystPHP web shell to make malicious files unreadable, unwritable, and non-executable, effectively locking them to prevent inspection or removal.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
Detects the execution of Asterisk PBX management commands to enumerate channels or peers, originating from a web server user. This behavior is indicative of a compromised web application or web shell, such as EncystPHP, being used to inspect or hijack telephony resources.
Detects attempts to modify Pluggable Authentication Modules (PAM) configuration files. Attackers may modify PAM configurations to bypass authentication, such as by adding `pam_permit.so` or changing module control flags from `required` to `sufficient` or `optional`.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
This rule detects potential credential harvesting and cryptocurrency wallet theft activities, specifically targeting browser data, SSH keys, cloud credentials, and crypto wallets. It looks for command-line patterns indicative of accessing or copying these sensitive files. The rule also includes a condition for Node.js processes attempting to exfiltrate credential-related data. The detection logic combines multiple conditions, such as browser credential access with SSH key theft, or cloud credential access with crypto wallet access, and Node.js exfiltration attempts combined with any of the credential/wallet access patterns.
This rule detects suspicious Node.js activity potentially related to EtherRAT's React2Shell exploitation (CVE-2025-55182) and fileless execution. It looks for combinations of fileless Node.js execution patterns (using -e, --eval, or --input-type=module with common modules like require, import, fetch, http) alongside Ethereum RPC queries (eth_call, eth_getStorageAt, infura.io, alchemy.com, cloudflare-eth). It also identifies scenarios where Node.js is downloaded from nodejs.org and then persistence mechanisms are set up via .bashrc, .profile, .bash_profile, systemd, or cron. Another detection path involves fileless Node.js execution combined with systemd or cron persistence. The rule specifically targets Linux environments and process creation events.
This rule detects activities associated with the EtherRAT self-propagating worm, specifically its module for scanning and exploiting vulnerable Next.js applications. It looks for combinations of mass port scanning tools (nmap, masscan, zmap, nc) targeting common web ports, logging of Next.js scan activities, `curl` commands with specific `Next-Action` headers indicative of Next.js exploitation, `node` or `nodejs` processes performing network connections to private IP ranges, and command lines containing patterns related to prototype pollution exploitation (e.g., `__proto__`, `constructor.prototype`). The rule correlates these activities to identify potential exploitation attempts against Next.js applications using the React2Shell vulnerability (CVE-2025-55182) and subsequent lateral movement or payload delivery.
Detects a Python process executing a binary from an in-memory file descriptor via the /proc filesystem. This technique was observed in the malicious 'sympy-dev' PyPI package, which used it to execute a cryptominer from memory, bypassing some file-based detections.
Detects network connections from a node.js process to a known C2 server address (87.236.177.9:3000) used by DPRK-linked threat actors.
This rule detects potential web server hijacking and traffic redirection activities, specifically focusing on techniques used by EtherRAT. It identifies scenarios where Nginx or Apache configurations are modified, often preceded by backup creation, and followed by a web server restart. Additionally, it looks for instances where configuration modifications are combined with attempts to exfiltrate data to webhook.site, suggesting a malicious redirection setup.
This rule detects patterns indicative of cryptomining malware execution, specifically targeting those distributed via impersonated PyPI packages. It looks for Python processes exhibiting characteristics such as: 1. Command lines containing keywords related to mining, cryptocurrency, hashing, and mining pools. 2. Python processes making suspicious network connections to stratum+tcp or mining pools. 3. Python processes engaging in resource-intensive operations like multiprocessing or threading, often utilizing all available CPU cores. 4. Python processes executing obfuscated code, potentially involving base64, zlib, or gzip decoding, combined with network requests. The rule triggers if any of these conditions are met, or if a combination of suspicious network activity and resource-intensive behavior, or obfuscated execution and resource-intensive behavior, is observed.
Detection of EtherRAT's SSH backdoor module that appends attacker-controlled public keys to authorized_keys. The rule correlates the creation of the .ssh directory with key injection and permission setting. It also identifies direct writes or appends to authorized_keys, and specific chmod operations on authorized_keys. Additionally, it looks for Node.js processes writing or appending to authorized_keys, indicating potential automated key injection.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
Detects execution of TruffleHog, an open-source tool used to search repositories, files, and environments for secrets and credentials. Adversaries may use it to discover exposed credentials or sensitive information within source code or configuration files
Detects ransom note creation associated with Yurei ransomware.
Detects known malicious file hashes associated with the VoidLink malware framework.
Detects the creation and execution of anonymous memory-backed files using `memfd_create`. This technique is used by malware like VoidLink to execute modular plugins or payloads directly in memory, bypassing disk-based detection mechanisms.
Page 299 of 341