Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,876
5,155
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Linux Pam Modification
YARA-L
Detects modifications to Linux PAM configuration files or module directories, potentially indicating PAM backdoor installation such as PamDOORa. Assigns higher risk for unusual processes or multiple file modifications.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects potential user namespace manipulation, a common precursor to kernel namespace exploits like Dirty Frag, by monitoring file modifications to uid_map and gid_map.
Detects write operations or modifications to 'uid_map', 'gid_map', or 'setgroups' files within the /proc directory.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
Detects a process modifying multiple privileged namespace mapping files (uid_map, gid_map, setgroups) under /proc. This behavior is used by the Dirty Frag xfrm-ESP exploit variant to gain CAP_NET_ADMIN privileges prior to exploiting the Linux kernel page-cache write vulnerability.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
PhantomRaven Temporary Payload Creation
Cortex XDR
Detects Node.js dropping the PhantomRaven dynamic Stage-3 payload into the /tmp directory. The attack utilizes a file-based temporary dropper that operates outside of standard NPM package paths, bypassing static code analysis.
This rule detects the creation, modification, or execution of files matching a predefined list of known malicious SHA256 hashes. It correlates file and process events to identify the presence and activity of these specific malicious artifacts on monitored systems.
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects anomalous file modification or deletion events targeting the SSH known_hosts file. This activity can be indicative of VECT ransomware, which zeroes out this file across compromised Linux and ESXi systems to suppress host-key warnings, enabling silent lateral movement via SCP and SSH.
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
This rule detects attempts to modify GRUB configuration files using common text editors. Adversaries may modify GRUB configuration to establish persistence, disable security features, or alter the boot process for malicious purposes.
This rule detects the presence of suspicious script content (e.g., 'system(', 'exec(', '/dev/tcp/') within Python (.py) or shell (.sh) files located in common plugin directories on Linux systems. This could indicate an attempt to inject malicious code into package management configurations for persistence or privilege escalation.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory, indicative of automated task deployment via Group Policy Preferences (GPP) commonly abused by adversaries. This activity can be used for persistence, privilege escalation, or lateral movement.
Detects file creation or modification events targeting /etc/systemd/system/persist.service, or the execution of 'systemctl enable persist'. This persistence mechanism is used by the Nexcorium Mirai variant to ensure the botnet survives reboots.
This rule detects the staging or execution of the LaxGopher payload, disguised as 'whisper.dll', by monitoring DLL loading and file writing events. It specifically looks for the filename 'whisper.dll' in ImageModuleLoad, PeFileWritten, or NewExecutableWritten events.
This rule detects the execution of the 'strip' utility on Linux systems, when it is used on a file located in common temporary directories or user home directories. Adversaries may use 'strip' to remove symbols from compiled binaries, making reverse engineering more difficult and potentially reducing file size, which can aid in obfuscation or evasion.
Detects attempts to modify file timestamps on Linux systems using the 'touch' command with the '-r' or '--reference' flags. This technique, known as timestomping, allows adversaries to change the access and modification times of a file to match those of another file, to evade detection or blend malicious files with legitimate ones.
This rule detects attempts to mount a bind from a temporary directory or other sensitive system directories on Linux systems. This behavior can be indicative of an attacker trying to hide malicious activity or gain persistence by mounting a bind from a compromised location to a system directory.
Page 97 of 110