Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
66
27
16
8
7
Contributors
42
35
23
8
6
Categories
82
74
67
56
51
Platforms
124
17
5
3
3
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
122
109
99
59
32
CVEs
1
1
1
1
1
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
Detects creation of new scheduled tasks (cron), systemd services, or startup entries that reference the reverse_ssh tool, consistent with attacker persistence established after vCenter compromise.
This rule detects the creation or modification of cron jobs that schedule recurring tasks (every 5 or 10 minutes) designed to download remote scripts using wget or curl and pipe them directly into a shell interpreter (sh or bash) for execution. This behavior is indicative of persistent malware, such as botnets, re-fetching and executing secondary payloads.
Detects SleeperGem RubyGems supply chain artifacts: hardcoded Forgejo C2 reference in gem Ruby source, the git-credential-manager binary dropped under the hidden gcm path, and supporting deploy.sh/persistence indicators (ping6 backdoor, systemd/cron service under the git-credential-manager name)
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects the mrmustard supply-chain implant establishing persistence by writing a crontab entry that invokes the compiled stealer 'hw_probe.pyc' every 15 minutes, or direct crontab command invocation referencing the file.
This rule detects various common methods of achieving persistence on Linux and macOS systems. It monitors file system changes to systemd unit files and macOS LaunchAgent plist files, as well as the execution of commands related to managing systemd services and user crontab entries.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Page 3 of 7