Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection to a non-private IP address on port 7712. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
This rule detects attempts to enable auditing of TTY input on Linux systems by monitoring modifications to PAM (Pluggable Authentication Modules) configuration files. Specifically, it looks for changes to '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' in conjunction with TTY-related audit events. This activity could indicate an adversary attempting to implement keylogging functionality using the pam_tty_audit module to capture user input.
Detects modifications to critical Unix shell configuration files. Adversaries may modify these files to establish persistence or elevate privileges by executing malicious commands when a new shell is opened or a user logs in.
Detects the execution of a shell command characteristic of APT36's use of malicious .desktop files on Linux. The command typically involves using 'curl' to download a hex-encoded payload and 'chmod' to make it executable, often within the a tmp directory.
Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of a vulnerability that allows arbitrary execution via webshells, such as CVE-2025-31324. The rule looks for common shell interpreters, scripting languages, and network utilities being executed from specific SAP NetWeaver directories.
Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command. This technique leverages the /proc filesystem to modify a running process's memory, which can be used for privilege escalation or defense evasion.
Detects attempts to discover files with setuid/setgid capabilities using the 'getcap' command. This activity is often a precursor to privilege escalation on Linux systems, as adversaries search for binaries that can be abused to gain higher privileges.
This rule detects the creation of new files within the `/etc/sudoers.d/` directory. Files in this directory can be used to grant specific users or groups elevated privileges without requiring a password, serving as a persistence mechanism for attackers to maintain privileged access.
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324, potentially leading to webshell deployment.
Detects the use of 'at' or 'atd' utilities, which are commonly abused by adversaries for persistence or to schedule the execution of malicious code. This rule specifically looks for the execution of '/at' or '/atd' binaries.
This rule detects connection attempts to the SSH service running on an OpenCanary honeypot node. OpenCanary is a honeypot designed to attract and detect unauthorized access attempts. A connection attempt to an SSH service on an OpenCanary instance indicates potential reconnaissance or attack activity against the honeypot, which should be investigated as it suggests an adversary is probing for vulnerable services.
Detects the start or reload of a service on Linux systems using 'systemctl' or 'service' commands. This can be indicative of persistence mechanisms or privilege escalation attempts where adversaries modify or create services to execute malicious payloads.
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
This rule detects the execution of the 'esxcli' command on an ESXi host with specific arguments to assign administrative permissions to an account. The command line must contain 'system', 'permission', 'set', and 'Admin', indicating an attempt to modify user permissions to grant administrative privileges. This activity is highly suspicious as it can lead to privilege escalation or persistence on the hypervisor.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root by specifying a user ID of -1 or 4294967295 (NO_UID_T) with the '-u' option, bypassing the sudoers policy.
Detects the use of the `mknod` syscall to create special files (e.g., character or block devices) on Linux systems. This syscall is rarely used by legitimate applications and can be abused by attackers or malware to create fake devices, interact with kernel interfaces, establish covert channels, bypass file system restrictions, or create backdoors.
Detects the creation of files named "ebpfbackdoor" within the "cron.d" and "sudoers.d" directories. This activity is associated with the TripleCross eBPF rootkit, which uses these locations for persistence.
These YARA rules are designed to identify executables compiled with specific programming languages: Rust, Golang, and Nim. They achieve this by looking for unique strings, section names, and other artifacts left by the respective compilers and runtime environments within PE (Windows) and ELF (Linux) files. The rules are primarily for file identification and profiling, rather than detecting malicious behavior directly. They help in understanding the technology stack of an executable, which can be useful in malware analysis, threat intelligence, and software inventory.
Detects potential data exfiltration activity associated with the 'Shai-Hulud' NPM package attack. This rule specifically looks for the execution of 'curl' with command-line arguments indicating data being sent ('-d') to a known malicious webhook.site URL.
This rule detects the creation of new systemd service unit files in standard systemd directories. Adversaries often create or modify systemd services to establish persistence or escalate privileges by executing malicious code at system startup or when specific events occur. The rule specifically looks for file creation events in '/usr/lib/systemd/system/', '/etc/systemd/system/', and user-specific '/.config/systemd/user/' directories, which are common locations for systemd unit files.
Detects the execution of the 'doas' utility on Linux systems. 'doas' allows standard users to execute commands as another user, typically root, similar to 'sudo'. This can be used by adversaries for privilege escalation or defense evasion.
Page 306 of 340