Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,419 detections
Filters
Last updated
All Time
Detection languages
529
348
171
163
130
Contributors
458
316
172
104
97
Categories
877
668
225
183
158
Platforms
1,331
233
183
47
31
Products / Services
10,657
9,755
6,688
4,418
3,745
1,419
MITRE Techniques
449
435
337
325
200
CVEs
28
22
10
9
7
Detects multiple methods used by adversaries to clear or disable Linux
shell command history (bash, zsh) in order to cover tracks and evade investigation.
shell command history (bash, zsh) in order to cover tracks and evade investigation.
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
This rule looks for the use of common interpeters in the context of editing binary login files.
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
This rule looks for the use of common interpeters in the context of editing binary login files.
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
Detects methods used by adversaries to clear or disable Linux shell command history (bash or zsh) in order to cover tracks and evade investigation.
Detects exploitation of CVE-2026-24061, an authentication bypass in GNU telnetd, where the 'login' process is spawned with the '-f' flag to skip authentication and gain root access.
This rule detects the use of the 'chmod' command to set overly permissive file permissions, specifically '777' (read, write, and execute for all users) in either octal or symbolic notation. It looks for 'chmod' as the executed command and then checks its arguments for '777', '0777', 'a=rwx', 'ugo+rwx', or 'a+rwx'. This activity can indicate a misconfiguration, a security vulnerability being introduced, or an attempt to bypass security controls.
Detects the DKnife gateway-monitoring framework, a toolset used by China-nexus actors for adversary-in-the-middle (AitM) attacks, based on specific file, network, and persistence artifacts.
Detects Bash /dev/tcp with HTTP request construction - high fidelity detection for payload download via raw sockets
Detects execution of cryptocurrency mining software often spawned by web server processes or executed from temporary directories. This behavior is common in post-exploitation scenarios, such as those involving vulnerabilities like XWiki CVE-2025-24893, where attackers deploy miners like XMRig. Sysmon For Linux EventID 1 is the best way to detect this behavior.
Detects the GNU telnetd service spawning the login binary with the '-f' flag, which is used to skip authentication. This is the primary indicator of the CVE-2026-24061 exploitation. This detection requires process creation logging on Linux, which can be enabled via tools like Sysmon for Linux.
Detects the exploitation of CVE-2026-24061, a critical authentication bypass vulnerability in GNU telnetd. The rule identifies when the 'telnetd' process spawns '/usr/bin/login' with the '-f' flag, which skips authentication and grants the attacker remote access.
Detects exploitation attempts of CVE-2025-42944, a critical insecure deserialization vulnerability in SAP NetWeaver AS Java RMI-P4 module. This rule identifies when SAP Java processes spawn system shells or execute suspicious commands, which is indicative of successful exploitation of the deserialization flaw. Attackers can exploit this vulnerability by sending malicious serialized Java objects to exposed RMI-P4 ports (typically 50004 or 50014), leading to arbitrary OS command execution with full system privileges. This pattern detects the post-exploitation behavior where the compromised Java process spawns interactive shells, creates scheduled tasks, or executes system commands.
Detects the use of GDB (GNU Debugger) to dump the memory of a running process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets from live processes without writing traditional credential dumping tools to disk.
Detects the creation of a local user account with root privileges (UID 0) using the 'useradd' command with the non-unique flag. This technique is used by threats like EncystPHP to create stealthy administrative accounts (e.g., 'newfpbx') for persistent access.
Detects the use of 'chmod 000' on PHP files within common web root directories. This technique is used by threats like the EncystPHP web shell to make malicious files unreadable, unwritable, and non-executable, effectively locking them to prevent inspection or removal.
Detects the execution of Asterisk PBX management commands to enumerate channels or peers, originating from a web server user. This behavior is indicative of a compromised web application or web shell, such as EncystPHP, being used to inspect or hijack telephony resources.
Detects attempts to modify Pluggable Authentication Modules (PAM) configuration files. Attackers may modify PAM configurations to bypass authentication, such as by adding `pam_permit.so` or changing module control flags from `required` to `sufficient` or `optional`.
Detects when the Landlock Linux Security Module (LSM) denies an access request from a sandboxed application. This indicates that a process is attempting to perform an action that violates its predefined security policy, which can be a sign of misconfiguration or malicious activity such as exploitation.
Detects malware masquerading as the 'init' process to evade detection. This rule specifically looks for processes named 'init' that do not have an instance ID of '1' and are not located in the standard '/sbin/init' or '/usr/lib/systemd/systemd' paths. It also flags processes in suspicious temporary directories.
Detects processes that masquerade as the 'init' process, a technique used by the GoBruteforcer malware. The rule identifies processes named 'init' while filtering out legitimate system init processes based on their process ID, parent process ID, and executable path.
Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.
Detects the creation of systemd services used by the PCPcat malware for persistence on Linux systems.
Page 51 of 68