Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the launch of processes whose associated file hash (SHA256) has a low prevalence across the monitored environment. Specifically, it flags processes where the SHA256 hash has been observed on 1 to 3 distinct endpoints over the past 10 days. This can indicate the execution of rare or newly introduced executables, which could be malicious.
This rule detects when a known malicious file, identified by its SHA256 hash through VirusTotal relationships, attempts to contact a domain that VirusTotal also associates with that file. It correlates DNS query events with VirusTotal intelligence to identify suspicious network communications originating from potentially compromised systems.
This rule detects buffer overflow attempts in Unix system log files by looking for specific keywords. These keywords include phrases indicating an attempt to execute code on the stack, known exploit strings like '0bin0sh1', a long string of 'A's (which can be indicative of buffer filling), and messages related to 'stack smashing detected'. The rule aims to identify malicious activity where an attacker tries to overflow a buffer to gain control of program execution, potentially leading to privilege escalation.
This rule detects attempts to create or rename files with a space at the end of their filename, which can be used to obfuscate malicious files or commands. Specifically, it looks for command-line executions involving 'echo "*" > * && chmod +x *' or 'mv * "* "'. The first pattern suggests creating an executable file with a trailing space, and the second suggests renaming a file to include a trailing space.
Detects suspicious log entries in Linux log files
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Detect DNS events that communicate with gaming sites in MISP. These violate policy.
IOC Domain C2
YARA-L
Detect DNS events that indicate communication to a C2 domain in MISP
Hash Prevalence
YARA-L
Correlate process events with hashes that have a low rolling max over the past 10 days
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Identify process creations that are tagged exploit in VT
Alert on known Hash querying a known hostname with VT Relationships
Alert on downloading a known file hash from a known IP with VT Relationships.
Detects buffer overflow attempts in Unix system log files
Detects suspicious log entries in Linux log files
Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings
GCTI Remote Access Tools
YARA-L
Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool list
GCTI Tor Exit Nodes
YARA-L
Alert traffic destined for known Tor exit nodes
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
Detects potentially suspicious child processes spawned by the SSH daemon (sshd) that execute commands using 'bash -c' or 'sh -c' as the root user. This behavior is indicative of potential exploitation of CVE-2024-3094, a backdoor in the XZ Utils library.
Page 318 of 340