Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects HTML phishing pages created by the 'IUAM ClickFix Generator'. These pages mimic browser verification challenges to trick users into executing malicious PowerShell or Bash commands to deliver infostealers like DeerStealer and Odyssey.
The analytic detects the creation or enabling of services on Linux platforms using the `systemctl` or `service` tools. It leverages Endpoint Detection and Response (EDR) logs, focusing on process names, parent processes, and command-line executions. This activity is significant as adversaries may create or modify services to maintain persistence or execute malicious payloads. If confirmed malicious, this behavior could lead to persistent access, data theft, ransomware deployment, or other damaging outcomes. Monitoring and investigating such activities are crucial for maintaining the security and integrity of the environment.
Tracks network events involving connections to specific Visual Studio Tunnel API URLs, which are used for remote development scenarios (like Visual Studio Code's Live Share or remote tunneling features).
This rule detects attempts to browse or access a predefined list of potentially malicious software packages. It monitors proxy logs for occurrences of these package names within the 'file.name' field. Further investigation of network traffic volume (bytes in/out) is recommended to ascertain if a download of the malicious package has taken place.
The following analytic identifies instances where users may have mistakenly entered their passwords in the username field during authentication attempts. It detects this by analyzing failed authentication events with usernames longer than 7 characters and high Shannon entropy, followed by a successful authentication from the same source to the same destination. This activity is significant as it can indicate potential security risks, such as password exposure. If confirmed malicious, attackers could exploit this to gain unauthorized access, leading to potential data breaches or further compromise of the system.
Detects suspicious child processes spawned by a Java process, which may indicate post-exploitation activity related to the Oracle E-Business Suite vulnerability CVE-2025-61882. The exploit chain often results in a reverse shell.
Modifying Crontab
Sigma
Detects suspicious modification of crontab file.
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects attempts to exploit a SQL injection vulnerability (CVE-2025-57819) in FreePBX via a malicious GET request to '/admin/ajax.php'. Attackers leverage this to achieve remote code execution by inserting a malicious cron job.
Detects suspicious child processes spawned by the GoAnywhere MFT Tomcat service. This behavior is consistent with post-exploitation activity following a successful remote code execution exploit of CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Detect attempt to enable auditing of TTY input
Detects the use of at/atd which are utilities that are used to schedule tasks.
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code
Detects potential exploitation of CVE-2025-41244, a local privilege escalation vulnerability in VMware Tools and Aria Operations.
An attacker can stage a malicious binary in a world-writable directory (e.g., /tmp) which is then executed with root privileges by the VMware service discovery mechanism when it attempts to determine the binary's version.
An attacker can stage a malicious binary in a world-writable directory (e.g., /tmp) which is then executed with root privileges by the VMware service discovery mechanism when it attempts to determine the binary's version.
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Detects the FlipSwitch Proof-of-Concept (PoC) Linux rootkit. This rootkit is designed to bypass modern Linux kernel (v6.9+) defenses by patching call instructions within the x64_sys_call function, a technique dubbed 'FlipSwitch'.
Page 309 of 340