Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,847
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
Detects Ruby processes executing with arguments explicitly disabling SSL/TLS verification (OpenSSL::SSL::VERIFY_NONE) while correlating with the presence of suspicious helper scripts ('loader.rb' or 'script.rb') within Ruby gem-related directories. This behavior is indicative of an adversary attempting to perform man-in-the-middle attacks or bypass security controls for outbound C2 communications.
Detects usage of the 'gem' command (install, build, push, publish) that includes naming patterns or specific command strings associated with the GemStuffer supply chain compromise campaign. This targets attempts to introduce malicious dependencies into the environment using RubyGems.
This rule detects file creation or modification events within the WordPress plugin directory for 'admin-menu-editor-pro'. Given that WordPress plugins are frequent targets for web shell placement, this rule monitors for unauthorized changes to the plugin's file structure, which may indicate an attempt to gain persistence or remote code execution on the web server.
Detects file-related operations (creation, modification, renaming, or deletion) performed on files containing 'acronis' or 'backup' in their path, executed by a process associated with Acronis, running under highly privileged system contexts (root or SYSTEM). This activity is indicative of potential unauthorized manipulation or disabling of backup software, commonly seen in ransomware attacks to inhibit recovery.
Detects unauthorized attempts to modify WordPress user tables (wp_usermeta) by web server processes to escalate privileges, specifically targeting the 'wp_capabilities' or 'administrator' flags. This activity is indicative of an exploit or post-exploitation behavior following a web-based attack.
Detects user creation, capability granting, or role modification events occurring on WordPress sites where the Admin Menu Editor plugin (versions 2.35 or 2.36) is active and the associated user account has administrator privileges. This pattern is often indicative of exploitation of known vulnerabilities in this specific plugin to perform unauthorized administrative actions.
Detects potential installation of compromised Admin Menu Editor Pro plugin updates by identifying sequential download events for specific plugin versions from the 'adminmenueditor.com' domain within a 24-hour window. This behavior is indicative of a supply chain attack where a legitimate update mechanism is leveraged to deliver malicious payloads without integrity verification.
This rule monitors for file creation or modification events related to the Admin Menu Editor Pro WordPress plugin, specifically looking for indicators of specific versions (2.35, 2.36) or file naming conventions. It also alerts on network communication to the plugin's domain, which could indicate a compromise or the use of an unauthorized or modified plugin version that may be associated with known vulnerabilities.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects the presence of PHP web shell code within the Admin Menu Editor Pro WordPress plugin directory. This rule targets indicators of a supply chain compromise where a legitimate plugin update is backdoored to include malicious PHP code designed for remote command execution via HTTP requests.
Detects DNS resolution requests for the domain 'myaccount.microsoft.com', which is the Microsoft account management portal. This activity is often associated with legitimate user authentication or account configuration processes, but can be used as part of reconnaissance or credential-related activities.
Detects individual process-level invocations of Microsoft Graph API endpoints commonly used for reconnaissance of user, group, and role information. This rule acts as a precursor signal to identify potential enumeration activities within an Office 365 environment.
Detects the execution of Acronis management or recovery tools (associated with cPanel, WHM, or Plesk environments) by a non-root user that results in a process running with root privileges. This pattern is indicative of potential privilege escalation by exploiting vulnerabilities in service-level utilities.
Detects instances where a process running as 'root' modifies files within an Acronis-related directory. This specifically alerts when the modifying process is not identified as a known, authorized Acronis backup service, potentially indicating unauthorized tampering with backup archives or configuration files.
Detects instances where a non-root user executes commands containing 'acronis' alongside web hosting management keywords (cpanel, whm, plesk) while the target process user is 'root'. This behavior suggests an attempt to abuse backup software or administrative management tools to escalate privileges or perform unauthorized administrative actions.
Page 88 of 340