Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Detects the FlipSwitch Proof-of-Concept (PoC) Linux rootkit. This rootkit is designed to bypass modern Linux kernel (v6.9+) defenses by patching call instructions within the x64_sys_call function, a technique dubbed 'FlipSwitch'.
This rule detects the presence of Olymp Loader malware by identifying known malicious file hashes (SHA256) and network communication with associated distribution domains. It looks for these indicators across various data sources, normalizing fields for consistent output. The rule aims to identify systems infected with or communicating with Olymp Loader infrastructure.
Yara rule that detects BPFDoor backdoor.
Detects the creation or modification of specific files identified as indicators of compromise (IOCs) used by UNC4841 in their exploitation of Barracuda ESG appliances. These files are associated with various stages of the attack, including persistence, execution, and defense evasion.
Detects the execution of various infostealers and RATs, such as BeaverTail, OtterCookie, WeaselStore, and AkdoorTea, used by the North Korea-aligned threat actor DeceptiveDevelopment.
Detects a high volume of file rename operations where files are appended with a randomized 16-character hexadecimal extension. This is a characteristic behavior of LockBit 5.0 ransomware during its encryption phase.
Detects potential Cloudflare Under Attack Mode (UAM) bypass activity, characteristic of the ShadowV2 botnet. This involves the execution of a headless browser followed by network requests using a Cloudflare clearance cookie.
Detects the PHP file handler variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the creation of a PHP web shell file named 'hafuab.php' in '/usr/local/webui/' by an 'echo' command, which includes PHP code to display 'test - Open source project (github.com/test/test)' and 'phpinfo()'. This activity is indicative of an attacker attempting to establish persistent access and gain information about the web server environment.
Detects BadIIS malware variants associated with the 'Operation Rewrite' campaign (CL-UNK-1037). This rule identifies the native IIS module, PHP backdoors, and other related components used for SEO poisoning.
Malicious NPM Package Version Download
Cortex XDR
This rule detects the download or installation of known malicious NPM package versions by monitoring process command-line arguments for specific package names and versions. It targets common package managers like npm, yarn, and pnpm, as well as node.exe, to identify instances where a compromised or intentionally malicious package is being introduced into a development or production environment.
This rule detects the Linux_Backdoor_PondRAT malware by identifying specific byte patterns associated with its 'connect_proxy', 'send_payload', and 'execute_shell_command' functions. The rule targets ELF executables.
This query identifies Linux devices with vulnerable versions of the Common Unix Printing System (CUPS) installed, which are susceptible to remote denial-of-service and authentication bypass attacks as described in CVE-2025-58364 and CVE-2025-58060. The rule filters for CUPS software packages on Linux systems and compares the installed version against a known vulnerable version cutoff. This cutoff is a placeholder and must be updated with specific version information from official vendor advisories.
New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes — patch to Linux 6.1.15+ or rate-limit TCP/445 to mitigate.
This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:
This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:
MCP Remote RCE Via Oauth
YARA-L
Detects potential remote code execution via a malicious OAuth URL in the mcp-remote proxy tool, indicative of CVE-2025-6514 exploitation.
Detects processes potentially related to XillenStealer making outbound network connections or DNS queries for telegram.org. This is indicative of command and control or data exfiltration activity.
Page 316 of 347