Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects the 'ted' backdoor or similar malicious activity attempting to manipulate HAProxy's internal connection counters by accessing or writing to the HAProxy process memory (/proc/[pid]/mem or /proc/self/mem). This behavior is characteristic of an attempt to evade backend logging and statistics tracking by directly modifying process memory structures.
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
Detects attempts to tamper with Microsoft Windows Defender configuration, specifically by modifying exclusion paths via PowerShell cmdlets (Add-MpPreference, Set-MpPreference), direct registry modifications, or forced Group Policy updates. It also monitors for the disabling of Tamper Protection via registry and the creation of scheduled tasks designed to apply Defender exclusions.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
Detects the presence of small PHP files containing both PHP execution tags and path traversal sequences. This pattern is indicative of a web shell or malicious script placed outside of intended directories via path traversal exploitation.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
This rule detects file access, creation, modification, or renaming operations involving sensitive files associated with cryptocurrency wallets (Bitcoin, Electrum, ElectrumSV), game account configurations (Battle.net, Steam, Minecraft), and browser-based cookies (Roblox). The rule filters out legitimate process interactions, identifying suspicious activity from unknown or unauthorized applications potentially attempting to exfiltrate credentials or session tokens.
This rule detects file access, creation, modification, or renaming operations involving sensitive files associated with cryptocurrency wallets (Bitcoin, Electrum, ElectrumSV), game account configurations (Battle.net, Steam, Minecraft), and browser-based cookies (Roblox). The rule filters out legitimate process interactions, identifying suspicious activity from unknown or unauthorized applications potentially attempting to exfiltrate credentials or session tokens.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects the creation or modification of a specific file ('libvirtlog.so.0') located in '/usr/lib/' which acts as a gating mechanism for the curlRAT malware. The detection correlates this file event with processes commonly associated with system management that are executing with command line arguments indicative of malicious activity (e.g., 'reverse', 'pty').
This rule detects either the execution of a specific SSH daemon binary known to be trojanized or the creation/modification of files within the /var/lib/sshd/ directory, which is a common indicator of backdoor persistence or credential theft targeting SSH sessions.
Detects the 'ted' backdoor or similar malicious activity attempting to manipulate HAProxy's internal connection counters by accessing or writing to the HAProxy process memory (/proc/[pid]/mem or /proc/self/mem). This behavior is characteristic of an attempt to evade backend logging and statistics tracking by directly modifying process memory structures.
Page 41 of 110