Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,419 detections
Filters
Last updated
All Time
Detection languages
529
348
171
163
130
Contributors
458
316
172
104
97
Categories
877
668
225
183
158
Platforms
1,331
233
183
47
31
Products / Services
10,657
9,755
6,688
4,418
3,745
1,419
MITRE Techniques
449
435
337
325
200
CVEs
28
22
10
9
7
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
detects BPFDoor .lock and .pid files access in temporary file storage facility
Detects malicious/suspicious systemd generator files for persistence mechanisms
Detects the use of the 'setcap' utility with parameters that assign all Linux capabilities to a binary file.
This capability can be abused to create a backdoored binary, for privilege escalation, and bypassing security controls.
This capability can be abused to create a backdoored binary, for privilege escalation, and bypassing security controls.
Detects persistence establishment after docker container escape
Detects persistence establishment after docker container escape
Detects an adversary stopping or disabling the Linux audit daemon (auditd), the primary kernel-level activity logging subsystem on Linux.
Disabling auditd eliminates syscall-level telemetry including file access, process execution, and privilege escalation events.
Effectively attempting to blind the host's logging pipeline before further action.
Observed in: TeamTNT, Rocke cryptominer campaigns, post-exploitation frameworks (Metasploit, Sliver) during cleanup phases.
Disabling auditd eliminates syscall-level telemetry including file access, process execution, and privilege escalation events.
Effectively attempting to blind the host's logging pipeline before further action.
Observed in: TeamTNT, Rocke cryptominer campaigns, post-exploitation frameworks (Metasploit, Sliver) during cleanup phases.
Detects usage udev rules launching at jobs or cron jobs for persistence
Linux VNC Install
Sigma
Detects VNC-based lateral movement activities. Looking for the initial install
Detects the creation or modification of udev rules that execute suspicious commands or scripts from unusual locations. Udev rules are used by the Linux kernel device manager to handle hardware events and can be abused for persistence.
Detects scripts designed for container escape and host persistence
Detects usage udev rules launching at jobs or cron jobs for persistence
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
Detects malicious udev rules for persistence
Detects a process running with a name that mimics a Linux kernel worker thread (e.g., 'kworker/...') but is not running as the root user. This is a known masquerading technique used by malware such as ClipXDaemon to evade detection.
Detects the modification of the .profile file to establish persistence, a technique used by the ClipXDaemon malware. The rule looks for a command that appends the execution of a file from the `~/.local/bin` directory to the `.profile` file.
Detects the creation or modification of Python scripts in the /unitree/etc/programming/ directory on Unitree Go2 robots. This activity is a strong indicator of exploitation of CVE-2026-27509 or CVE-2026-27510, where an attacker uploads a malicious script for remote code execution.
This detection is designed to help you find activity related to BRICKSTORM espionage backdoor (appliances/vCenter). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
This rule detects attempts to transfer tools or other files between systems in a compromised environment using common utilities like scp, rsync, wget, or curl. This rule should be used for hunting in your environment.
This rule set detects indicators of compromise associated with the RESURGE activity targeting Ivanti Connect Secure devices, as described by CISA. It looks for specific file hashes, the presence of a covert socket path (.logsrv), and modifications to key Ivanti filesystem artifacts such as LD_PRELOAD, DSUpgrade.pm, coreboot.img, and scanner.py. A match indicates potential compromise and requires further investigation to confirm the asset role, timing of file appearance, and comparison with approved maintenance windows. If hits are found, collect logs and file copies, reduce external exposure, and look for unusual activity like unexpected administrator actions or unfamiliar outbound connections.
Detects a command that downloads remote content and immediately runs it with bash. This is a common way to run attacker controlled code on a Linux host.
Page 49 of 68