Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
Detects SSH persistence planted during the Red Heron campaign: authorized_keys file writes under a .ssh folder, correlated with process command lines referencing authorized_keys and the operator's observed key comment naming pattern (backdoor / root-shell).
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
Detects instances where processes other than the primary web browsers (Chrome, Brave, Firefox) create, rename, or modify sensitive browser data files like 'Cookies' or 'Login Data'. This behavior is indicative of credential theft or data exfiltration attempts where an adversary is accessing browser-stored information.
This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.
Detects the creation or modification of a specific file ('libvirtlog.so.0') located in '/usr/lib/' which acts as a gating mechanism for the curlRAT malware. The detection correlates this file event with processes commonly associated with system management that are executing with command line arguments indicative of malicious activity (e.g., 'reverse', 'pty').
Detects the 'ted' backdoor or similar malicious activity attempting to manipulate HAProxy's internal connection counters by accessing or writing to the HAProxy process memory (/proc/[pid]/mem or /proc/self/mem). This behavior is characteristic of an attempt to evade backend logging and statistics tracking by directly modifying process memory structures.
This rule detects modifications to Group Policy Objects (GPO) or Microsoft Entra (formerly Azure AD) policies that weaken established security controls. For GPO, it monitors Event ID 5136 for changes to security-relevant attributes (e.g., disabling firewall or real-time monitoring) in Active Directory. For Entra, it monitors audit logs for administrative operations that reduce security posture, such as disabling MFA, lowering authentication trust, or deleting Conditional Access policies. It includes filters to exclude legitimate, documented change management activities.
Detects a suspicious sequence of events where the Parallels Desktop dispatcher service (prl_disp_service) executes a tar command with a compression program flag, followed immediately by the creation or modification of a launch agent (.plist) file in system or user launch directories. This pattern is indicative of exploitation or post-exploitation activity attempting to achieve persistence.
This rule detects unauthorized modifications to the /etc/sudoers.d/ directory, specifically identifying files with a 'prl-rce-' naming pattern that contain 'NOPASSWD:ALL'. This configuration allows users to execute commands with elevated privileges (root) without requiring a password, which is a common technique used by attackers to maintain persistence and facilitate privilege escalation on Linux systems.
This rule detects unauthorized modifications to the /etc/sudoers.d/ directory, specifically identifying files with a 'prl-rce-' naming pattern that contain 'NOPASSWD:ALL'. This configuration allows users to execute commands with elevated privileges (root) without requiring a password, which is a common technique used by attackers to maintain persistence and facilitate privilege escalation on Linux systems.
This rule detects unauthorized modifications to the /etc/sudoers.d/ directory, specifically identifying files with a 'prl-rce-' naming pattern that contain 'NOPASSWD:ALL'. This configuration allows users to execute commands with elevated privileges (root) without requiring a password, which is a common technique used by attackers to maintain persistence and facilitate privilege escalation on Linux systems.
This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.
This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.
Detects instances where node, npm, or bun package installation processes modify the Claude AI settings.json file. This could indicate potential supply chain compromise or unauthorized configuration changes to the Claude application environment via malicious packages or scripts.
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
Detects suspected exploitation of CVE-2026-81963, an Elevation of Privilege vulnerability in the Windows Update stack. The rule monitors for the creation of reparse points, junctions, or symbolic links within update staging paths by Windows Update processes, followed by either the spawning of suspicious child processes or unauthorized file writes/renames outside of expected directories, which are indicative of a privileged link-following exploit.
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
Page 30 of 110