Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
This rule monitors for modifications to critical Name Service Switch (NSS) configuration files (/etc/nsswitch.conf) or the creation/loading of NSS shared library files (/lib/libnss_*.so). Adversaries may target these files to manipulate identity management, gain persistence, or escalate privileges by intercepting authentication requests.
Detects the deployment and execution of GS-Netcat (gsocket), a tool often used for creating persistent reverse shells or backdoors. The rule identifies processes associated with gsocket, instances where the 'uptime' command is masqueraded with suspicious command-line arguments, and unauthorized creation or modification of systemd service files designed for persistence.
Detects potential tampering with Pluggable Authentication Modules (PAM) or configuration files on Linux systems. This includes the loading of non-standard shared libraries by authentication-related processes (sshd, sudo, login), modification of core PAM modules (e.g., pam_unix.so) by non-package manager processes, and unauthorized modifications to files within /etc/pam.d/. It also monitors for credential-related activity where authentication processes write data into temporary or hidden directories.
Detects Linux processes running from non-standard directories that exhibit network beaconing behavior, correlated with the concurrent creation or modification of systemd unit files on the same host. This pattern is indicative of a remote access trojan (RAT) or backdoor establishing persistent command-and-control.
Detects unauthorized systemd service unit installation or modification, specifically targeting reverse shells or encrypted tunneling tools (e.g., gs-netcat, netcat) by monitoring systemctl commands referencing suspicious paths (/tmp, /var/tmp, etc.) that bypass standard package management workflows. This behavior is associated with the Velvet Ant threat group's persistence tactics on compromised Linux systems.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
Detects post-exploitation activities on SD-WAN appliances, including unauthorized tenant list uploads related to CVE-2026-20245, creation of unauthorized 'troot' accounts in sensitive system files, staging of system files, unauthorized permission modifications via chmod/chown, and privilege escalation attempts using su.
This rule detects potential SSH brute force attacks by identifying high-frequency authentication failures from sshd logs (more than 10 failures in 5 minutes) and rapid, potentially automated connection attempts on port 22 (more than 20 connections in 1 minute) originating from the same source IP on Linux systems.
Detects instances where a Python process is spawned by npm or node and subsequently attempts to access sensitive browser or cloud credential files. This pattern is characteristic of malicious npm packages used for credential theft.
Detects the post-exploitation pattern associated with the DirtyClone (CVE-2026-43503) vulnerability, where a non-root process executes '/usr/bin/su' with the '-c /bin/sh' argument, resulting in a spawned shell running with root privileges. This behavior is indicative of an in-memory patch to the su binary's page cache, allowing for unauthorized privilege escalation without modifying the on-disk binary or triggering standard PAM authentication events.
Detects potential dynamic linker hijacking on Linux systems by monitoring for the use of non-standard LD_PRELOAD paths in process command lines or unauthorized modifications to the /etc/ld.so.preload configuration file, which can be used to inject malicious code into processes.
Detects anomalous behavior associated with the PHP 8.5.7 SOAP remote code execution (RCE) vulnerability. The detection monitors for PHP/PHP-FPM processes spawning suspicious child processes (e.g., shell, python, powershell), the creation of specific exploitation marker files (e.g., php857_rce, rpoc.php), and suspicious command-line patterns indicative of payload execution or command-based exploitation techniques.
Detects the creation of a hidden shell script file at '/etc/profile.d/.sh.local', a common persistence mechanism used by the MYRA RAT. This file is automatically executed by POSIX-compliant shells during the login process to maintain persistence on Linux systems.
Detects automated lateral movement attempts using sshpass to perform password spraying or authentication against PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule specifically flags the use of sshpass with lax security settings (StrictHostKeyChecking=no), identifying a pattern associated with the uon_fanout.sh post-exploitation script.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Detects the execution of 'opsec_enum.sh', a post-exploitation cleanup script, and associated activity involving ZipSlip-based webshell persistence components (such as 'mkzip34.py' and specific chunked file names) used by the threat actor MexicanMafia during Operation Escaneo.
Detects attempts to exploit the PwnKit vulnerability (CVE-2021-4034) in Polkit's pkexec. The rule monitors for malicious command-line arguments involving GCONV_PATH environment manipulation, the execution of pkexec by non-root users, and the presence of associated PwnKit payload artifacts, such as base64-encoded strings or specific chunked files.
This rule detects post-execution activity associated with the lambsys/isp.sh cryptominer campaign. It triggers when a known miner binary (lambsys, procq, or isp.sh) is executed, followed within 3 minutes by suspicious cleanup operations including the deletion of log files (wtmp, btmp, system logs), staging directories, or tampering with command history files and shell environment variables.
Detects suspicious user account creation activity or direct modification of the /etc/passwd file. The rule flags the use of 'useradd' or 'adduser' commands, as well as unauthorized attempts to inject root users into the passwd file, specifically looking for indicators like 'troot' (a common misconfiguration or backdoor username pattern).
Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.
Detects anomalous credential exfiltration attempts by GitHub Actions runners. The rule monitors for runner child processes (printenv, env, set) attempting to access sensitive CI/CD variables, or networking tools (curl, wget) transmitting data to unauthorized external endpoints, consistent with Miasma worm behavior.
Page 34 of 51