Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
Detects the use of the `sysinfo` system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage `sysinfo` to fingerprint the system, gathering data to determine if it's a viable target.
This rule detects outbound network connections to IP addresses that exhibit low prevalence within the monitored environment. Specifically, it flags connections to IPs that have a rolling maximum prevalence of 1 to 3 occurrences over a 10-day period. This behavior can be indicative of command and control (C2) communication, data exfiltration, or other suspicious activities where adversaries might use newly registered or rarely seen infrastructure.
This rule detects outbound network connections to known Tor exit nodes. It leverages a Google Cloud Threat Intelligence (GCTI) feed that provides a list of current Tor exit node IP addresses. The rule specifically looks for allowed network connections where the target IP address is identified as a Tor exit node by the GCTI feed. This can indicate an attempt to anonymize network traffic, which is often associated with malicious activity.
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", "last", "uname", "users", "w", and "who" on Linux systems. Adversaries use these commands to gather information about the system and its users to inform subsequent actions.
Detects the creation of a process that includes environment variables for HTTP or HTTPS proxy settings in its command line. This can indicate an attempt to route network traffic through a proxy, potentially for command and control or to bypass network restrictions.
This rule detects the launch of processes whose associated file hash (SHA256) has a low prevalence across the monitored environment. Specifically, it flags processes where the SHA256 hash has been observed on 1 to 3 distinct endpoints over the past 10 days. This can indicate the execution of rare or newly introduced executables, which could be malicious.
This rule detects when a known malicious file, identified by its SHA256 hash through VirusTotal relationships, attempts to contact a domain that VirusTotal also associates with that file. It correlates DNS query events with VirusTotal intelligence to identify suspicious network communications originating from potentially compromised systems.
This rule detects buffer overflow attempts in Unix system log files by looking for specific keywords. These keywords include phrases indicating an attempt to execute code on the stack, known exploit strings like '0bin0sh1', a long string of 'A's (which can be indicative of buffer filling), and messages related to 'stack smashing detected'. The rule aims to identify malicious activity where an attacker tries to overflow a buffer to gain control of program execution, potentially leading to privilege escalation.
This rule detects attempts to create or rename files with a space at the end of their filename, which can be used to obfuscate malicious files or commands. Specifically, it looks for command-line executions involving 'echo "*" > * && chmod +x *' or 'mv * "* "'. The first pattern suggests creating an executable file with a trailing space, and the second suggests renaming a file to include a trailing space.
Detects suspicious log entries in Linux log files
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Detect DNS events that communicate with gaming sites in MISP. These violate policy.
Hash Prevalence
YARA-L
Correlate process events with hashes that have a low rolling max over the past 10 days
IOC Domain C2
YARA-L
Detect DNS events that indicate communication to a C2 domain in MISP
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Identify process creations that are tagged exploit in VT
Alert on known Hash querying a known hostname with VT Relationships
Alert on downloading a known file hash from a known IP with VT Relationships.
Detects buffer overflow attempts in Unix system log files
Page 324 of 347