Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Yara rule that detects PondRAT backdoor.
Detects potential misuse of AI model APIs by correlating process creation, network activity, and non-standard AI service ports.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Detects outbound Network File System (NFS) connections originating from an internal network IP address to a public IP address. This activity is highly unusual for legitimate NFS usage and could indicate an attempt to download malware, exfiltrate data, or establish command and control, as observed with malware like RapperBot.
Detects if the eBPF sensor of Defender for Endpoint (Linux) is deactivated to evade detections.
Detects the s1ngularity malware attempting to add a shutdown command to shell configuration files (`.bashrc`, `.zshrc`) for persistence and system lockout.
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system. Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging. Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
Detects the malicious telemetry.js file used in the s1ngularity supply chain attack. This script harvests sensitive developer assets and exfiltrates them to attacker-controlled GitHub repositories.
This rule detects the execution of the 'getcap' binary on Linux systems. Adversaries often use 'getcap' during reconnaissance to identify binaries with special capabilities that could be exploited for privilege escalation, such as GTFOBins or other vulnerable executables. The rule specifically looks for the use of 'getcap' with the '-r' flag, which recursively lists capabilities.
This rule detects the execution of any process that originates from the '/tmp/' directory on a Linux system. The '/tmp/' directory is often used by adversaries to stage and execute malicious payloads, as it is typically writable by all users and can be used to bypass certain security controls. The rule specifically excludes executions of '/usr/bin/nextcloud' from '/tmp/' to reduce false positives.
Detects the execution of a malicious Linux payload, possibly within a .desktop file, a technique used by APT36. The rule identifies a bash process executing an inline command that downloads and runs a payload, often using a combination of curl, xxd, base64, and eval.
This YARA rule detects the Pumakit rootkit on Linux systems. It identifies specific byte patterns associated with the rootkit's syscall hooking mechanisms, including patterns related to hooking `rmdir` and `gdents64` functions. The rule looks for these distinct code sequences within executable files to indicate the presence of the Pumakit rootkit.
Detects host-based artifacts of the Tomcat remote Kernel Backdoor, specifically the communication between the LKM and the userland component via the /proc/acpi/pcicard file.
Detects potential GTFOBins abuse on Linux systems where a root shell is spawned by a suspicious parent process (e.g., find, perl, vim, tar, etc.).
This rule relies on DeviceProcessEvents in Microsoft Defender XDR and is intended for environments where Auditd, Sysmon for Linux, or similar native logging is not available.
Note: This detection does not cover all GTFOBins. It focuses specifically on cases where:
- A root-owned shell is spawned
- The parent process is known to be capable of shell escape or privilege abuse
- The child command appears interactive or escape-like
It does not detect:
- Non-shell-based GTFOBin techniques (e.g., file exfiltration via scp, curl, etc.)
- GTFOBin usage that doesn't result in a new shell (e.g., privilege escalation via
misconfigured capabilities)
- Abuse of GTFOBins run under non-root accounts
The query includes logic to detect both high-signal exploitation patterns and suspicious shell spawns, while excluding common false positives (e.g., package post-install scripts and benign environment checks).
This rule relies on DeviceProcessEvents in Microsoft Defender XDR and is intended for environments where Auditd, Sysmon for Linux, or similar native logging is not available.
Note: This detection does not cover all GTFOBins. It focuses specifically on cases where:
- A root-owned shell is spawned
- The parent process is known to be capable of shell escape or privilege abuse
- The child command appears interactive or escape-like
It does not detect:
- Non-shell-based GTFOBin techniques (e.g., file exfiltration via scp, curl, etc.)
- GTFOBin usage that doesn't result in a new shell (e.g., privilege escalation via
misconfigured capabilities)
- Abuse of GTFOBins run under non-root accounts
The query includes logic to detect both high-signal exploitation patterns and suspicious shell spawns, while excluding common false positives (e.g., package post-install scripts and benign environment checks).
Detects suspicious downloads or fetches of common privilege-escalation tools such as winPEAS, linPEAS, PowerUp, Seatbelt, SharpUp, WinPwn, PrivescCheck, Sherlock, Watson, BeRoot, LinEnum, LSE/LES, Linux Exploit Suggester, pspy, or GTFObins. These tools are often used by adversaries after initial access to enumerate the environment and attempt local privilege escalation.
Detects potential Remote Code Execution (RCE) on a FortiWeb device, possibly related to CVE-2025-25257. The rule correlates a suspicious web request to a potential 'fabric' endpoint with a subsequent shell or utility process launch by the web server process on the same device.
The analytic detects the installation of a Linux kernel module using the `modprobe` utility. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
Yara rule that detects Pumakit rootkit.
This rule detects the presence and activity of PAM-based backdoors on Linux systems by looking for specific SHA256 hashes and filenames associated with known PAM backdoors. It monitors process events, general device events, file events, and image load events on Linux devices.
This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.
Page 311 of 340