Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Yara rule that detects GobRAT backdoor.
Yara rule that detects WolfsBane backdoor.
Detects the creation of Python path configuration files (.pth) within Python library folders on Linux systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically looks for files ending with '.pth' in typical Python site-packages directories.
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT.
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
Detects instances where an attacker attempts to interact with or exploit a REDIS service running on an OpenCanary honeypot. This indicates reconnaissance or an attempt to gain unauthorized access or extract data from the emulated Redis service.
Detects instances where a MySQL service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to gain unauthorized access to the honeypot's emulated MySQL service, which can be a sign of reconnaissance or credential stuffing activities.
This rule detects when a Git clone request is made to a Git service running on an OpenCanary honeypot. This indicates an adversary is interacting with the honeypot, likely attempting to collect information or test access.
Detects instances where an SMB service on an OpenCanary honeypot node has received a file open request. This indicates an adversary is interacting with the honeypot's SMB share, potentially attempting to discover or access files.
This rule detects when an OpenCanary honeypot receives a Session Initiation Protocol (SIP) request. OpenCanary is a honeypot designed to detect unauthorized activity by mimicking vulnerable services. A SIP request to an OpenCanary node indicates that an attacker or scanner has interacted with the emulated SIP service, which is typically an indicator of reconnaissance or an attempted attack against voice-over-IP (VoIP) infrastructure.
This rule detects a suspicious sequence of events: a process launching with a low prevalence executable (meaning it's rarely seen in the environment) followed by that same process initiating an HTTP connection to a low prevalence domain (a domain rarely accessed in the environment) within a 10-minute window. This combination can indicate the execution of novel or custom malware attempting to establish command and control or exfiltrate data to an unusual destination.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
DNS query to a recently created domain
Detects when a low prevalence hash is seen during a process launch event, and a low prevalence domain is accessed within 10m.
Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
Detects instances where an SIP service on an OpenCanary node has had a SIP request.
Detects instances where a TFTP service on an OpenCanary node has had a request.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
This rule detects the Helldown ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files for encryption, the encryption process itself, dropping a ransom note, and attempting to kill virtual machines. The rule specifically targets ELF executables, indicating it's designed for Linux systems.
This rule detects the PygmyGoat backdoor on Linux systems by identifying specific byte patterns associated with its functionality. The patterns include code for creating backdoor sockets, forwarding data, the main constructor, and hooking the accept function, indicating the presence and activity of the PygmyGoat malware.
Page 333 of 347