Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,227
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,978
2,471
1,062
1,026
910
Platforms
39,793
7,141
6,515
3,861
3,600
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,230
1,319
1,319
875
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects commandline operations on shell history files
Detects the start, reload or restart of a service.
Audio Capture
Sigma
Detects attempts to record audio using the arecord and ecasound utilities.
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects system information discovery commands
Detects a creation of systemd services which could be used by adversaries to execute malicious code.
Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Detects enumeration of local or remote network services.
Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
Detects process masquerading and resource abuse techniques used in the ShadowRay 2.0 campaign. This includes processes renamed to mimic legitimate system components (e.g., kworker, dns-filter) and the execution of known cryptominers from unusual locations.
Mimikatz payload has been executed on a system as one-liner likely to output to a file for collection
Detects the RedTail cryptominer targeting exposed Docker APIs by looking for specific HTTP request patterns, including the 'libredtail-http' user agent and 'docker.selfrep' parameter in the request body.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
This query detects execution of processes related to Visual Studio Code extension signing or caching that involve known Glassworm-compromised extensions. Based on indicators published by KOI (October 20, 2025), it identifies suspicious .vsix package operations potentially associated with self-propagating malicious VSCode extensions observed in OpenVSX and Microsoft VSCode marketplaces.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.
Detects XSS attempts injected via GET requests in access logs
Detects common shell processes launching a reverse shell using the '/dev/tcp' redirection. This technique is known to be used by adversaries like the Clop ransomware group for persistence and command and control.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.
Page 304 of 341