Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
303 detections
Filters
Last updated
All Time
Detection languages
96
87
44
29
15
Contributors
79
59
56
38
30
Categories
104
103
63
60
55
Platforms
229
91
43
23
8
Products / Services
10,680
9,761
6,694
4,418
3,744
303
MITRE Techniques
107
87
79
68
66
CVEs
3
3
2
2
2
IDS Classtypes
51
33
6
2
2
IDS Protocols
94
1
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
Detects unauthorized file write or rename operations targeting core OpenSSH binary and library paths, excluding known package manager activities. This behavior is indicative of an adversary replacing legitimate system binaries to create a trojanized version of OpenSSH, as observed in the Velvet Ant 'Operation Highland' campaign, used to harvest credentials and log SSH sessions.
Detects suspicious file creation activities by system authentication processes (e.g., sshd, su, sudo, PAM) in known staging directories (/tmp, /var/tmp, /dev/shm) or SSH configuration paths. The rule looks for hidden files or files with specific extensions (.log, .dat, .bak) often associated with malicious backdoored components used to intercept and store credentials in plaintext.
Detects instances where the Claude Code AI agent or its subprocesses are used to establish persistence. This is achieved by monitoring for crontab modifications or direct writes to SSH authorized_keys files, which are common indicators of post-exploitation activity following an Axiom-style indirect prompt injection.
Detects anomalous SSH connections originating from internal network appliances or DMZ-segment devices (e.g., storage, firewalls) to multiple internal network hosts. This behavior is indicative of lateral movement or SSH tunneling as observed in the VerdantBamboo BRICKSTORM campaign, where edge devices are leveraged as pivot points.
This rule detects the installation, service configuration, and key management activities associated with the OpenSSH server on both Windows and Linux environments. It monitors for commands related to installing OpenSSH capabilities or packages, starting the sshd service, modifying SSH registry keys on Windows, creating or modifying configuration files (sshd_config), and updating authorized_keys files. It also flags inbound network connections to non-standard or default SSH ports originating from external IP ranges.
Detects successful SSH authentication to administrative accounts ('vmanage-admin' or 'admin') on Cisco Catalyst SD-WAN Manager (vManage) devices originating from IP addresses associated with the threat actor UAT-8616. This activity relates to exploits targeting CVE-2026-20127 and CVE-2026-20182 for unauthorized access via authentication bypass or certificate abuse.
This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.
Detects the unauthorized installation and service configuration of OpenSSH Server on Windows workstations. This technique is used to establish persistent, redundant backdoor access, as observed in Operation Poisson, where adversaries deploy it to maintain access alongside other tools like Tailscale.
Detects anomalous SSH daemon (sshd) activity characterized by the installation or execution of a non-standard sshd binary (often located in /tmp or /var/tmp) or the execution of sshd with suspicious command-line arguments (custom ports or custom configuration files), followed by modifications to the authorized_keys file. This behavior is indicative of unauthorized persistence or backdoor access.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
Detects multiple failed SSH authentication attempts against a server from a single source within a short timeframe, which is indicative of a brute force password attack.
This rule detects potential SSH brute force attacks by identifying high-frequency authentication failures from sshd logs (more than 10 failures in 5 minutes) and rapid, potentially automated connection attempts on port 22 (more than 20 connections in 1 minute) originating from the same source IP on Linux systems.
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Detects unauthorized access and command execution associated with MSP service accounts. The rule triggers on successful SSH authentication using specific service account names (e.g., egnyteservice) followed by the execution of interactive shells under those same service account contexts, which is indicative of potential lateral movement or compromise in downstream environments.
Detects multiple failed SSH login attempts from a single source IP address, indicating a potential brute force attack. The rule identifies 'Invalid user' or 'Failed password' messages in syslog from the 'sshd' process and groups them by source IP and time to count unique attempted users and total attempts. A threshold of more than 5 attempted users from a single source IP within a 10-minute window triggers an alert.
This rule detects instances where common web server processes (e.g., httpd, nginx) or system utility services (e.g., sshd, crond, dropbear) spawn shell processes like bash, sh, or ash. This activity is a classic indicator of potential remote command execution (RCE) via web application exploits or the abuse of legitimate system services to run arbitrary commands.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
Page 4 of 15