Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
303 detections
Filters
Last updated
All Time
Detection languages
96
87
44
29
15
Contributors
79
59
56
38
30
Categories
104
103
63
60
55
Platforms
229
91
43
23
8
Products / Services
10,680
9,761
6,694
4,418
3,744
303
MITRE Techniques
107
87
79
68
66
CVEs
3
3
2
2
2
IDS Classtypes
51
33
6
2
2
IDS Protocols
94
1
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Detects a root SSH sign-in from a public IP address or known attacker IP, followed within 30 minutes by a write or modification to the root authorized_keys file on the same device.
Detects non-root SSH execution performing remote port forwarding (-R) targeting a Unix socket bind on hosts running the tailscaled daemon, excluding known automation tools.
Detects potential SSH agent hijacking where process command line activities reference SSH authentication sockets or environment variables, followed closely by a successful SSH connection to a remote host from the same device.
Detects evidence of exploitation and post-exploitation activity related to CVE-2026-59310, an unauthenticated RCE vulnerability in the VMware vCenter Syslog Server. The rule monitors for suspicious child processes spawned by vmsyslogcollector, directory traversal patterns in command lines, and persistence mechanisms involving SSH authorized_keys modification, cron job creation, or systemd unit deployment on the VCSA shell.
This rule monitors Linux system authentication logs to identify potential unauthorized access attempts. It triggers when a single source IP initiates a high volume of failed SSH login attempts (brute force) or when a single user account is targeted by multiple distinct source IPs within a short time window (password spraying).
Detects potential misuse of SSH credentials by identifying successful SSH logins from source IP addresses that have not been observed in the previous 14 days, or successful SSH logins occurring within one hour of an authorized_keys file modification on the same host. This combination of behaviors is indicative of an adversary establishing or using persistence via SSH key manipulation.
This rule detects potential brute-force activity against remote access services (OpenVPN, StrongSwan, WireGuard, and SSH) on Linux hosts by monitoring Syslog for patterns indicating repeated failed authentication attempts. It further highlights instances where a burst of failed attempts is followed by a successful authentication for the same source IP, indicating a potential successful compromise.
Detects repeated SSH authentication failures originating from an external source on port 22, where the username pattern appears to be programmatically generated or enumerated (e.g., username followed by digits). This behavior is characteristic of automated brute-force attempts targeting common SSH services.
Detects the creation or modification of SSH authorized_keys or authorized_keys2 files. This is a common persistence technique used to maintain remote access by adding an adversary-controlled public key to a user's configuration, often performed after initial access through exploitation of public-facing services.
This rule identifies suspicious post-exploitation activity where an anomalous or unauthenticated NetScaler VPN session (potentially exploiting CVE-2026-88771 or CVE-2026-88772) is followed by the creation or modification of SSH authorized_keys files or related credential manipulation commands on internal hosts, suggesting an attacker establishing persistence.
Detects configuration changes to AAA/TACACS+ settings or the creation of local administrative accounts on network devices executed over SSH or Telnet sessions. This behavior is associated with malicious activity by groups such as Salt Typhoon, involving the compromise of telecommunications infrastructure.
Detects the execution of the 'fanout.sh' utility from the /tmp directory, which subsequently spawns 'sshpass' child processes to perform rapid, non-interactive SSH authentication attempts ('StrictHostKeyChecking=no') against multiple internal hosts within a 10-minute window. This behavior is indicative of automated lateral movement, specifically observed by threat actor UNC6240.
Detects potential misuse of SSH credentials by identifying successful SSH logins from source IP addresses that have not been observed in the previous 14 days, or successful SSH logins occurring within one hour of an authorized_keys file modification on the same host. This combination of behaviors is indicative of an adversary establishing or using persistence via SSH key manipulation.
Detects unauthorized modifications to the .ssh/authorized_keys file. Such changes are often performed by adversaries to establish persistence by ensuring their own public keys allow them remote access to the host. The rule filters out known configuration management and system tools to reduce noise.
Detects high-volume SSH authentication failures from a single source IP address within a short time frame, which is indicative of credential spraying or brute force activity.
Detects evidence of an argument-injection attack against MikroTik RouterOS (CVE-2026-86060), where the attacker provides the literal username '-2' during the login process. This action allows the attacker to bypass standard credential validation by exploiting a forged privilege mask. This is typically observed in conjunction with unauthorized access attempts following CVE-2026-67279.
Detects a high frequency of SSH connection attempts originating from a single source address within a short timeframe, specifically targeting the initial SSH handshake string. This is indicative of automated brute force or credential stuffing activity against SSH services.
Detects anomalous SSH login attempts using the username '-2', which exploits a known argument-injection vulnerability (CVE-2026-86060) in MikroTik RouterOS. This vulnerability allows an attacker to bypass authentication and obtain unauthorized administrative privileges by forcing the login process to read privilege levels from the terminal file descriptor.
Detects high-volume SSH authentication attempts originating from a single source IP targeting a server on port 22, indicating a potential brute force attack.
Detects outbound connections to a known malicious C2 infrastructure associated with the CARBONATO threat actor. The rule identifies both established SSH sessions using the OpenSSH implementation and the initiation of outbound TCP connections on ports dynamically determined by an MD5 hash, which is a known behavior of this actor's C2 communication strategy.
Page 1 of 15