Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
Detects the execution of the `iwpriv` utility by an unprivileged user targeting subcommands that are vulnerable to Local Privilege Escalation (LPE) in certain MediaTek Wi-Fi drivers. The exploitation of these vulnerabilities is demonstrated to be possible by unprivileged users, making the execution of kernel-level configuration tools like `iwpriv` by non-root users a highly suspicious activity.
Detects the presence of a file with a specific SHA-256 hash associated with a Linux Sliver TCP Pivot implant. This implant has been linked to the CL-CRI-1036 group and is used as a precursor to 01flip ransomware deployment. The rule searches across file and process events for this high-fidelity indicator of compromise.
Detects when a common web server process (node, nginx, apache, apache2, httpd) spawns `curl` or `wget`. This behavior is a strong indicator of post-exploitation activity, as seen in the exploitation of vulnerabilities like CVE-2025-55182 (React2Shell), where attackers download second-stage payloads.
Detects the mass renaming or creation of files with the '.01flip' extension, which is characteristic of the 01flip ransomware. A high count of these files on a single host is a strong indicator of an active ransomware infection.
Detects the creation or modification of the '/tmp/sslvpn.log' file, a known artifact of a new Linux variant of the Lazarus BADCALL backdoor.
Detects the execution of the command to stop the vCenter remote management service (vpxa) on an ESXi host. This is a technique used by the RansomHouse MrAgent tool to inhibit system recovery and impair defenses before deploying the Mario encryptor.
Detects the execution of Node.js with the '-e' flag, which evaluates a string as JavaScript. This technique is used by the EtherRAT implant for fileless execution, particularly for privilege escalation attempts.
Detects the renaming of VMware virtual machine related files to a new file ending with the '.emario' extension. This behavior is characteristic of the RansomHouse 'Mario' encryptor.
This rule detects the execution of known proxyware applications such as Infatica, Honeygain, and IPRoyal by looking for specific command-line arguments. Proxyware applications monetize unused internet bandwidth by routing traffic through the user's device, which can pose security and privacy risks.
Detects the specific command-line sequence used by the 01flip ransomware on Linux to erase itself from the disk after encrypting files. This involves using 'sleep' for a delay, 'dd' to overwrite the file with random data, and 'rm' to delete it.
Detects the disabling of the VMware ESXi firewall using 'esxcli', a technique used by the RansomHouse 'MrAgent' tool as a defense evasion tactic before encryption.
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects the execution of the ESXi command 'esxcli network firewall set --enabled false' used by the RansomHouse MrAgent deployment tool to disable the host's firewall. This is a defense evasion technique used to ensure C2 communication and subsequent ransomware deployment.
Detects the renaming of critical virtualization files by the RansomHouse 'Mario' encryptor, which appends an extension containing '.mario' (e.g., '.emario'). This activity is a strong indicator of a successful encryption event on an ESXi host.
Detects the ransom note file 'How To Restore Your Files.txt' created by the RansomHouse 'Mario' encryptor.
Detects the creation of suspicious files (e.g., web shells, executables) by a Node.js or Next.js server process. This activity is a common post-exploitation step after a successful RCE, such as from exploiting CVE-2025-55182 (React2Shell), where an attacker drops a backdoor for persistence.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects exploitation of a remote code execution vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The attack involves an authentication bypass followed by the upload and execution of a malicious XSLT template, leading to command execution and potential web shell deployment.
Detects the creation of suspicious child processes (e.g., shells, network tools) by a Node.js or Next.js server process. This could indicate successful remote code execution, potentially related to vulnerabilities like React2Shell (CVE-2025-55182).
Page 307 of 347