Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
79 detections
Filters
Last updated
All Time
Detection languages
40
20
9
7
1
Contributors
40
16
14
3
2
Categories
22
14
13
12
11
Platforms
46
24
15
4
2
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
26
25
14
11
11
CVEs
1
1
1
1
1
IDS Classtypes
6
2
1
IDS Protocols
8
1
Detects command-line operations indicative of bulk data export, dumping, or unauthorized scanning against vector databases (e.g., Pinecone, Chroma, Milvus, Qdrant) and caching backends (e.g., Redis). Such activities may indicate an adversary attempting to exfiltrate training data, embeddings, or context stored within an AI agent's memory backend.
Detects instances where the Redis server process or the Redis AOF check utility writes directly to common SSH authorized_keys file paths. This behavior is indicative of an attacker exploiting a Redis misconfiguration or vulnerability (e.g., Redis RCE) to establish persistence by injecting an unauthorized SSH key.
Detects attempts to modify the Redis configuration (dir or dbfilename) followed by a SAVE command, which can be leveraged to write arbitrary data to critical system files such as crontabs for persistence.
This rule detects suspicious activity associated with Redis server processes attempting to write to SSH 'authorized_keys' files or executing commands (such as BGREWRITEAOF or directory reconfiguration) commonly used by attackers to inject malicious SSH public keys into a Redis installation for persistent remote access.
Detects the Redis server process writing or modifying files within cron configuration directories. This is a common persistence technique used by attackers to gain recurring execution after exploiting vulnerable or misconfigured Redis instances.
Detects a Redis process connecting to a suspected rogue replication master (using non-standard ports or known malicious IPs) followed by a file modification to a system cron directory. This sequence is indicative of a Redis Rogue Replication exploit where a crafted RDB file is used to achieve persistence by writing a malicious entry to a cron job.
Detects potential reconnaissance activities targeting Redis services on port 6379, specifically looking for unauthenticated 'PING' commands and subsequent responses indicating either authentication requirements or an open, unauthenticated instance.
Detects unauthorized modification of system cron files by the redis-server process, indicative of rogue redis replication exploitation, followed by the execution of a cron job associated with the XMRig cryptocurrency miner.
This rule detects a suspicious sequence of events indicative of a Redis Lua sandbox escape. It monitors for a network connection to Redis (port 6379) followed shortly by the redis-server process reading the system's /etc/passwd file, which is a known indicator of an attempted arbitrary file read via the EVAL command.
Detects high-frequency, unauthenticated Redis PING/AUTH attempts indicative of a reconnaissance scan against the Redis service. This activity typically represents an adversary performing mass fingerprinting or attempting to identify unsecured Redis instances.
Detects attempts to bypass the Redis Lua scripting environment sandbox by injecting 'require' and 'dofile' commands within an 'EVAL' request. These commands are typically used to load external modules or files, which, if successful, could allow an attacker to achieve arbitrary code execution on the server hosting the Redis instance.
Detects the creation of files within the /etc/cron.d/ directory initiated by the redis-server process, specifically looking for malicious payloads containing bash -c and /dev/tcp/ command wrappers indicative of a reverse shell or beaconing persistence mechanism often used by Redis-targeting botnets.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects a malicious command sequence targeting Redis instances where an attacker uses 'CONFIG SET' to modify the 'dir' and 'dbfilename' configuration directives followed by a 'SLAVEOF' or 'REPLICAOF' command. This is a common exploit pattern used to achieve remote code execution by forcing the Redis instance to load a malicious database file (often containing binary webshells or cron jobs) from an attacker-controlled server.
Detects the deployment and activity of SilkParasite-associated Linux threats, including XMRig cryptocurrency miner shell scripts and standalone Meterpreter agents. The rule also captures the execution of a custom Python fleet-scanning tool used to interact with exposed Redis instances for unauthorized command execution and infrastructure management.
Detects outbound HTTP GET requests containing a specific '/ping' URI pattern and 'h=' query string parameter, characteristic of Redis-based cryptomining botnet C2 heartbeat check-ins.
Detects instances where a Redis server process, or its child process, writes a file named 'verify.html' into the web root directory '/var/www/html/'. This behavior is characteristic of adversaries abusing compromised Redis instances to deploy web shells or command-and-control beacons for persistent access.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Page 1 of 4