Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects processes associated with Acronis backup software executed by a user other than 'root', while the effective user context of the process is 'root'. This behavior often indicates an attempt to exploit setuid binaries or misconfigured permissions to execute commands with elevated privileges.
Detects instances where the Acronis backup agent or associated plugin processes spawn a shell (e.g., sh, bash, zsh, perl) under the root user context. This behavior is highly irregular and may indicate a compromised backup utility, the use of backup agent processes to execute arbitrary commands, or unauthorized privilege escalation.
This rule detects potentially malicious activity involving Linux backup software (Acronis) or attempts to modify file permissions (chmod setuid) to elevate privileges. It triggers when backup-related processes are executed by root or when commands indicative of privilege escalation or tampering occur in conjunction with backup-related paths or binaries.
Detects the presence of PHP web shell code within specific versions (2.35/2.36) of the Admin Menu Editor Pro plugin. This rule targets malicious files introduced via a supply chain compromise of the plugin's update distribution channel, specifically looking for common PHP obfuscation and execution functions associated with web shells.
This rule detects the creation of a new administrator account in WordPress within one hour of a specific plugin update event (specifically for the 'admin-menu-editor-pro' plugin). This pattern is indicative of a post-exploitation activity where a compromised or vulnerable plugin is used to gain administrative access to the WordPress instance.
Detects the use of chmod, chown, or chattr to modify file permissions on paths related to backup (Acronis) or hosting management (cPanel, WHM, Plesk) software. Specifically monitors for command-line arguments indicating a change to world-writable permissions (e.g., 777, o+w, a+rwx) on sensitive configuration files.
Detects the use of chmod, chown, or chattr to modify file permissions on paths related to backup (Acronis) or hosting management (cPanel, WHM, Plesk) software. Specifically monitors for command-line arguments indicating a change to world-writable permissions (e.g., 777, o+w, a+rwx) on sensitive configuration files.
This rule detects scenarios where a web server process or control panel utility (such as cPanel or Plesk) appears to initiate a shell process (sh, bash, dash) as the root user. This behavior is highly indicative of a compromise where an attacker has achieved command execution in an elevated context following an exploit against a web application or control panel interface.
Detects the creation of a new administrator account in WordPress by monitoring for SQL INSERT operations targeting the wp_users and wp_usermeta tables that involve setting the wp_capabilities to administrator. This behavior is indicative of unauthorized account creation often associated with compromised or malicious WordPress plugin updates.
This rule monitors for DNS queries and network traffic directed toward specific domains and subdomains identified as associated with the SpiceRAT, NodeEdgeRAT, and NomadRAT malware infrastructure. It correlates data from DNS events and general security/network logs to detect potential command and control (C2) communication patterns, regardless of specific source IP overlap.
Detects DNS resolutions of known SpiceRAT command-and-control hostnames to multiple distinct C2 IP addresses within a 30-day window. This behavior is consistent with automated C2 infrastructure rotation or the use of multiple redundant IP addresses for persistence.
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects high-frequency outbound TCP connection attempts from a WSO2 API Gateway or Traffic Manager host to multiple sensitive internal management and administrative ports (22, 445, 3389, 5985, 5986). This behavior is indicative of a compromised gateway being used for lateral movement across the network.
Detects unauthorized attempts to modify, delete, or truncate backup configuration files and data directories associated with cPanel, WHM, and Plesk environments. This rule monitors for common file manipulation commands (e.g., rm, mv, truncate) targeting sensitive paths like /etc/acronis, /etc/cpanel/backups, and other backup-related directories, excluding actions performed by authorized service accounts.
Detects instances where web server worker processes such as php-fpm, apache, or nginx spawn shell interpreters (sh, bash, dash). This behavior is often indicative of web shell execution, where an adversary leverages a compromised web application to execute arbitrary commands on the underlying host.
Page 72 of 340