Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
Detects the use of 'COPY TO PROGRAM' syntax within Cisco Email Security Appliance (ESA) logs. This pattern is indicative of potential command injection or OS command execution attempts often associated with exploitation of database-related functionalities, specifically targeting Cisco ESA management or backend interfaces.
Detects the use of 'COPY TO PROGRAM' syntax within Cisco Email Security Appliance (ESA) logs. This pattern is indicative of potential command injection or OS command execution attempts often associated with exploitation of database-related functionalities, specifically targeting Cisco ESA management or backend interfaces.
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects shell/install scripts that deploy an XMRig-based Monero cryptominer, consistent with the install script planted on the LeakySensey git repository server
Detects embedded CVE-2026-46300 (Fragnesia) Linux privilege escalation exploit code used by KATARU IoT malware, copied unmodified from public PoC
This rule detects potential privilege escalation to root originating from Acronis backup plugin processes on hosting platforms like cPanel, WHM, and Plesk. It flags cases where a non-root Acronis process spawns a child process with root effective UID or when the process UID itself changes to zero, potentially exploiting vulnerabilities such as CVE-2026-87886. The rule also correlates this behavior with suspicious file permission changes (chmod/chown) on Acronis plugin directories.
Detects unauthorized attempts to modify, delete, or truncate backup configuration files and data directories associated with cPanel, WHM, and Plesk environments. This rule monitors for common file manipulation commands (e.g., rm, mv, truncate) targeting sensitive paths like /etc/acronis, /etc/cpanel/backups, and other backup-related directories, excluding actions performed by authorized service accounts.
Detects repeated process execution events associated with Acronis backup plugins for cPanel, WHM, or Plesk within a 15-minute window. This behavior is consistent with automated exploitation attempts, specifically referencing CVE-2026-87886, which target these backup management plugins to achieve privilege escalation or unauthorized system access.
This rule detects potentially malicious command execution patterns in Linux environments. It monitors for shell commands (bash, sh, echo, tee, cat) involving base64 decoding redirected to shell configuration files (e.g., .profile) or specific patterns involving 'gs-dbus' processes, which are often used by threat actors to decode obfuscated payloads or maintain persistence.
Detects the creation of persistence mechanisms on Linux systems using APT Pre/Post-Invoke hooks (e.g., /etc/apt/apt.conf.d/99sys-update) or user profile initialization scripts (e.g., /etc/profile.d/sys-init.sh). The rule monitors for these files containing suspicious command strings such as curl downloads, xmrig mining configurations, or specific init-hook markers often used by cryptomining botnets.
Detects the use of the 'getevent' utility by processes running under the 'shell' user (UID 2000) or accessing '/dev/input' directories, which is indicative of keylogging behavior often utilized by the RatHat Android malware to capture user input.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
This rule detects shell processes (sh or bash) being spawned from suspicious, commonly writable directories (e.g., /tmp, /dev/shm) within a short window of file system activity (creation, modification, or deletion) and associated MQTT protocol network communication. This pattern is indicative of potential malware staging or command-and-control activity on Linux systems.
Detects the use of chmod, chown, or chattr to modify file permissions on paths related to backup (Acronis) or hosting management (cPanel, WHM, Plesk) software. Specifically monitors for command-line arguments indicating a change to world-writable permissions (e.g., 777, o+w, a+rwx) on sensitive configuration files.
Detects the use of chmod, chown, or chattr to modify file permissions on paths related to backup (Acronis) or hosting management (cPanel, WHM, Plesk) software. Specifically monitors for command-line arguments indicating a change to world-writable permissions (e.g., 777, o+w, a+rwx) on sensitive configuration files.
This rule detects scenarios where a web server process or control panel utility (such as cPanel or Plesk) appears to initiate a shell process (sh, bash, dash) as the root user. This behavior is highly indicative of a compromise where an attacker has achieved command execution in an elevated context following an exploit against a web application or control panel interface.
Detects potential exploitation of CVE-2026-87886 in the Acronis Backup plugin for cPanel & WHM, where an adversary uses insecure file permissions to elevate privileges. The rule monitors for execution of file permission or ownership changing utilities (chmod, chown) targeting files associated with backup plugins.
Page 9 of 51