Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
66
27
16
8
7
Contributors
42
35
23
8
6
Categories
82
74
67
56
51
Platforms
124
17
5
3
3
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
122
109
99
59
32
CVEs
1
1
1
1
1
Detects instances where a Node.js process spawns the 'crontab' utility, likely to modify user cron jobs. This is a common technique used by attackers to achieve persistence by scheduling periodic execution of malicious scripts or reverse shells.
Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
Detects multiple techniques associated with Linux post-exploitation and persistence, including LD_PRELOAD environment variable hijacking, suspicious cron jobs, profile.d persistence modifications, systemd service masquerading via prctl, and fileless execution via memfd_create.
Detects persistence mechanisms associated with the MYRA RAT on Linux systems, including the creation or modification of cron jobs (specifically targeting .cache-update.sh), registration of a malicious shared object via /etc/ld.so.preload, and the installation of a login hook in /etc/profile.d/.
Detects persistence mechanisms used by the lambsys/procq cryptominer. It identifies two specific behaviors: 1) Correlation of non-root process execution (isp.sh, lambsys, procq) followed within 120 seconds by modifications to cron configuration files (e.g., /etc/cron.d/, /var/spool/cron/crontabs/) containing suspicious command-line patterns or mining pool references. 2) Direct detection of crontab -e invocations using heredoc redirection (<<) to install persistence payloads that match known miner dropper patterns and mining pool endpoints.
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
Detects indicators of persistence activity associated with the MYRA RAT. This includes unauthorized modifications to shared library preload mechanisms (/etc/ld.so.preload), creation of malicious shared objects in systemd user paths by common interpreter/shell processes, suspicious modification of cron job files by those same processes, and the execution of the 'systemd-userdbd' process from non-standard, unauthorized filesystem locations.
Detects persistence mechanisms associated with the MYRA Linux RAT, including LD_PRELOAD hijacking for shared library redirection, malicious cron job creation with specific scheduling (13-minute intervals), and unauthorized modifications to profile.d scripts to execute malicious code.
Detects when a non-root user modifies, creates, or renames files within common cron directories or the main crontab file on Linux systems. This activity can indicate an attempt to establish persistence or schedule malicious tasks.
This rule detects potentially malicious cron job activity, including modifications to crontab files, execution of cron jobs from world-writable directories (such as /tmp or /dev/shm), and the usage of unusual prime-number timing intervals which are commonly used by attackers to evade standard scheduling patterns.
Detects indicators of the MYRA Linux RAT, including fileless execution via memory-based techniques (memfd_create/fexecve), process masquerading as systemd-userdbd, and persistence mechanisms leveraging LD_PRELOAD and malicious cron jobs.
Detects MYRA Linux RAT establishing cron-based persistence by scheduling /usr/local/lib/.cache-update.sh to execute every 13 minutes with a fileless fallback chain using memfd_loader and agent_launcher. Indicative of the apintergrationpost npm supply chain attack by threat actor kimijohn01.
Detects suspicious cron utility activity, including modifications or executions, with specific indicators associated with the MYRA malware family. This rule identifies attempts to establish persistence or execute malicious code via scheduled tasks on Linux systems.
Detects cron job creation for Linux persistence or execution
Detects when scripting language interpreters (Node, Python, Bun, NPM) create or modify files within the '/etc/cron.d/' directory. This activity is suspicious as it may indicate a compromised package or malicious actor attempting to establish system-wide persistence via scheduled tasks.
Detects cron job creation for Linux persistence or execution
This rule detects the execution of SUID binaries by a non-root user, immediately followed by the creation of a persistence mechanism such as a systemd service file or a cron job. This correlation aims to identify potential privilege escalation attempts where an attacker uses an SUID binary to gain elevated privileges and then establishes persistence on the system.
Detects the execution of the `crontab` binary by common web server service accounts on Linux systems. This activity is highly suspicious as it indicates an attacker leveraging remote code execution (RCE) in a web application to establish persistence via scheduled tasks.
Detects the creation of crontab entries executing a payload masquerading as a legitimate Linux dynamic linker (ld-unix.so.2). Masjesu uses this highly specific path and filename combination to disguise its primary persistence mechanism.
Page 5 of 7