Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Awk System Execution
Cortex XDR
This rule detects the execution of 'awk' on Linux systems when its command line contains includes suspicious functions like. This pattern is often indicativeof malicious script execution or command injection attempts using awk.
Detects make explicitly loading a Makefile from temporary or non-standard locations, often used to run arbitrary commands (due to writeable capability) via a trusted build utility.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
This rule detects a potential privilege escalation attempt on Linux systems. It looks for two main indicators: first, the execution of the 'su' command from a user's home directory by a process whose executable was recently created in a user's home directory and identified as an ELF binary. Second, it identifies systems where public-facing network connections were made by processes using common remote file transfer utilities (curl, wget, lftp, axel, aria2, scp, rsync, ftp) to fetch code, followed by the execution of a process with 'algif-aead' in its command line, which could indicate fileless execution after remote code fetching. The combination suggests an attacker might be fetching malicious code, potentially compiling it, and then using it to escalate privileges via 'su' or executing it filelessly.
Detects the execution of the public Dirty Frag exploit tool by monitoring for its hardcoded command-line arguments (--force-esp, --force-rxrpc). This vulnerability allows local attackers to gain root privileges via page-cache tampering in the Linux kernel without race conditions.
Detects suspicious command execution originating from cPanel daemons. This rule identifies instances where cPanel processes (cpsrvd, cpsrvd-ssl, cpaneld, whostmgrd) or their immediate children execute common shell interpreters or specific commands indicative of potential compromise, such as writing to /etc/passwd, modifying authorized_keys, or using base64/perl/python/bash for interactive shells.
This rule detects suspicious child processes spawned by the BeyondTrust Remote Support client (bomgar-scc), which could indicate post-exploitation activity following a compromise via vulnerabilities like CVE-2026-1731. It looks for high-risk command line patterns and suspicious child processes commonly used for reconnaissance and payload execution.
Detects the creation of DaemonSets in a Kubernetes cluster using the `kubectl` command-line tool. DaemonSets are designed to run a copy of a Pod on all (or some) nodes in the cluster, making them a powerful mechanism for persistence and cluster-wide credential harvesting by attackers. This rule specifically looks for `kubectl` commands that include 'daemonset' and either 'create' or 'apply' operations.
Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.
High-confidence detection for probable Copy Fail exploitation requiring AF_ALG or algif_aead references, syscall-style splice usage, and privileged binary targeting. https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py https://xint.io/blog/copy-fail-linux-distributions#how-we-found-it-9
This rule detects the execution of the 'su' command on Linux systems. The 'su' command is used to run commands with a substitute user and group ID, most commonly to switch to the root user. Related to Copy Fail
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects when AI-integrated IDEs or coding agents spawn sensitive child processes such as command shells (cmd, powershell, pwsh) or web transfer tools (curl, wget). This behavior could indicate malicious activity if an attacker compromises the AI tool or if the tool itself is misused to execute arbitrary commands or exfiltrate data.
Susp AWK Command Execution
Gravwell
This rule detects suspicious execution of the 'awk' command on Linux systems. Specifically, it looks for 'awk' commands that include suspicious patterns. This pattern is often indicative of malicious script execution or code injection attempts using 'awk' for arbitrary command execution.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary command execution.
This rule detects attempts to modify GRUB configuration files using common text editors. Adversaries may modify GRUB configuration to establish persistence, disable security features, or alter the boot process for malicious purposes.
This rule detects the presence of suspicious script content (e.g., 'system(', 'exec(', '/dev/tcp/') within Python (.py) or shell (.sh) files located in common plugin directories on Linux systems. This could indicate an attempt to inject malicious code into package management configurations for persistence or privilege escalation.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary command execution.
Detects the execution of the 'dvr' downloader script and subsequent 'nexuscorp' payload executions used by the Nexcorium Mirai variant botnet. This rule specifically looks for `wget` downloading 'dvr' from an IP address, direct execution of './dvr', or execution of 'nexuscorp' with an architecture-specific 'dvr' payload.
Page 36 of 45