Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
This rule detects unauthorized or suspicious write operations to Linux Pluggable Authentication Modules (PAM) configuration files or shared libraries. PAM controls authentication for various system services; unauthorized modification of these files is a common technique used by attackers to establish backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common system package management utilities to reduce noise.
Detects instances where a Perl interpreter attempts to mask itself as a Samba (smbd) service process, or where smbd/perl processes initiate network connections on port 5000, and identifies smbd processes spawned by non-standard parent processes like sh, bash, or perl, which is indicative of potential unauthorized service manipulation or backdoor activity.
Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.
This rule detects potentially malicious or masqueraded Samba (smbd) activity on Linux systems. It monitors for three conditions: smbd processes launched from non-standard binary paths, smbd process network activity from non-standard binary paths, and smbd processes spawned by unauthorized or unexpected parent processes. These patterns are often associated with unauthorized SMB service deployment, malware persistence, or masquerading techniques.
Detects the JDY botnet's infection chain on Linux systems, characterized by script-based processor architecture reconnaissance followed by the retrieval, execution, and subsequent deletion of architecture-specific (MIPS) binaries. This rule monitors shell-based command sequences involving system information gathering, network-based file downloads, and immediate removal of the downloaded file.
Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.
Detects Linux processes masquerading as common system utilities (e.g., sshd, cron, smbd) by executing from non-standard, often high-risk directories such as /tmp, /var/tmp, /dev/shm, /opt, or various home and dot-directories. This behavior is indicative of Velvet Ant's TTPs used to blend malicious binaries with standard system processes to maintain persistence and evade detection.
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
Detects the use of screen capture utilities such as ffmpeg, grim, scrot, or xwd, which are often used by the MYRA RAT to capture live desktop sessions for exfiltration.
Detects the 'procq' process establishing network connections to common Monero (XMR) mining pool ports. This behavior is indicative of a cryptominer deployment, specifically associated with the Langflow cryptominer campaign related to CVE-2026-33017.
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
Detects the execution of a binary from the Linux shared memory directory /dev/shm.
This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.
This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.
Detects persistence mechanisms associated with the MYRA Linux RAT, including LD_PRELOAD hijacking for shared library redirection, malicious cron job creation with specific scheduling (13-minute intervals), and unauthorized modifications to profile.d scripts to execute malicious code.
Detects process execution or file creation/modification events associated with the PACKET_EDIT_MEME (pedit_cow_demo) exploit, which targets Linux kernel vulnerabilities (CVE-2026-46331) for local privilege escalation.
Detects fileless execution of the MYRA Linux RAT, which utilizes memfd_create and fexecve to load an ELF binary directly into memory. The detection identifies malicious payloads masquerading as the systemd-userdbd process when spawned by non-standard parent processes such as shell interpreters, node, or npm, as well as abnormal command-line arguments.
This rule detects attempts to tamper with critical Linux log files such as /var/log/auth.log, /var/log/syslog, and /var/log/audit/audit.log. It specifically looks for file deletion or modification events, or process creation events that involve commands like 'rm', 'shred', 'truncate', 'unlink', or 'dd' targeting these log files. Legitimate processes like 'logrotate', 'rsyslog', 'syslog-ng', 'auditd', 'systemd', and 'journald' are excluded to reduce false positives.
This rule detects modifications to SSH authorized_keys files on Linux-based SD-WAN controllers, or successful SSH public key authentication events involving the vmanage-admin user, including attempts to identify authentication from unexpected source IP addresses.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Detects evidence of post-exploitation anti-forensic activity on Cisco SD-WAN components (vManage, vSmart, vBond). This rule monitors for unauthorized removal of logs and exploitation artifacts, the clearing of shell command history, and suspicious modification of file and directory permissions on critical system paths.
Page 37 of 51