Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,419 detections
Filters
Last updated
All Time
Detection languages
529
348
171
163
130
Contributors
458
316
172
104
97
Categories
877
668
225
183
158
Platforms
1,331
233
183
47
31
Products / Services
10,657
9,755
6,688
4,418
3,745
1,419
MITRE Techniques
449
435
337
325
200
CVEs
28
22
10
9
7
Detects common shell tools accessing OpenClaw plaintext workspace secrets such as the .env file under ~/.openclaw/workspace/.
Detects a file with a .mp5 extension in the /tmp directory being made executable via chmod. This technique was used by a stager to deliver the Rekoobe backdoor by masquerading ELF binaries as media files to evade detection.
Detects archiving of OpenClaw workspace data which may contain plaintext conversations and secrets, consistent with collection and staging for exfiltration.
Detects the execution of iptables to set the default policy for a chain (INPUT, OUTPUT, or FORWARD) to ACCEPT. This technique was used by a stager in a campaign delivering the Rekoobe backdoor to weaken the host's firewall posture and ensure C2 communication.
Detects Linux cron persistence, log tampering, outbound IRC ports, or compiler use from temp paths, matching SSHStalker botnet tradecraft.
Detects attempts to disable or stop the 'auditd' service on Linux systems using common service management utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses and avoid logging of their malicious actions.
This rule detects activities associated with the SSHStalker botnet. It identifies outbound IRC-like network traffic on common IRC ports (6667, 6697, 7000) over TCP. It also looks for persistence mechanisms by monitoring writes to common cron job directories and files on Linux systems. Additionally, the rule detects log tampering attempts by monitoring writes to critical system log files such as /var/run/utmp, /var/log/wtmp, and /var/log/lastlog. Finally, it identifies on-host compilation activities, specifically the execution of compilers (gcc, cc, clang) or build tools (make) within suspicious temporary directories like /tmp, /var/tmp, or /dev/shm, which can indicate malware compilation.
Detects suspected DKnife gateway AitM activity by matching Linux process/file artifacts (component names and config files) described in the Talos DKnife disclosure.
This rule detects activities associated with UNC6201 exploitation of Dell RecoverPoint VM, specifically looking for three distinct phases: Tomcat Manager WAR file deployment, modification of a persistence script on Linux, and communication with a GRIMBOLT C2 endpoint. The first part identifies WAR file deployments via Tomcat Manager. The second part looks for modifications to a specific persistence script file. The third part identifies network connections to a known GRIMBOLT C2 IP address or URL pattern.
Detects execution of processes with filenames referenced in GRIDTIDE reporting, such as xapt and related components.
This rule detects various indicators associated with the SSHStalker botnet on Linux systems, including outbound IRC-like network connections, modifications to cron files for persistence, log tampering (specifically utmp/wtmp/lastlog files), and the execution of compilers from suspicious directories like /tmp or /dev/shm. Each section of the rule targets a specific behavior of the botnet.
This rule detects activities related to the DKnife gateway, which is associated with Adversary-in-the-Middle (AitM) attacks. It identifies the creation of specific DKnife process names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin), file events involving DKnife configuration artifacts (rules.conf, sslmm.cfg, url.cfg), and the presence of specific marker strings ("dkimsi=", "460110672021628", "PASSWORD") in logs or captured payloads. The rule aims to identify the presence and activity of DKnife components on Linux systems.
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
Detects activity related to Network Discovery.
Here, one group of network commands has to match for the rule to trigger.
Here, one group of network commands has to match for the rule to trigger.
This rule detects attempts to use outdated or weak cryptographic algorithms and protocols by monitoring command-line arguments of common network and cryptographic utilities. Specifically, it looks for the use of RC4, DES, 3DES, RSA1024, MD5 ciphers, or TLS 1.0, TLS 1.1, and SSL 3.0 protocols, as well as the '--insecure' flag, when executed by applications like openssl, gpg, ssh, or curl. This could indicate an adversary attempting to downgrade cryptographic protections to facilitate eavesdropping or other attacks.
The following rule detects attempts to tamper with Linux log records by looking for interpreter processes, or common utility commands interacting with critical log files such as /var/log/wtmp, /var/log/btmp, or /var/run/utmp. It also includes scenarios where 'dd' or 'cp' might be used with /dev/null or /dev/zero to effectively clear or overwrite log content.
Detects interactive shell execution within a container in a production Kubernetes namespace, using the 'exec' command.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Detects the execution of iptables commands used for Single Packet Authorization (SPA), a technique observed being used by UNC6201. This rule identifies when iptables is configured to inspect traffic on port 443 for a specific hex string, which is a key component of the actor's C2 proxying tradecraft.
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
The following detects interactive shell execution within a container in a production K8s namespace.
This could be indicative of an attacker with a compromised user account attempting to control a container.
This could be indicative of an attacker with a compromised user account attempting to control a container.
Detects deleting of K8s log events. Indicating Defense Evasion tactics, and covering of tracks.
Page 50 of 68