Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
This rule detects the use of 'openssl' or 'base64' for decoding data piped into a shell (bash, sh, zsh) or scripting interpreter (python, perl). This pattern is often used by adversaries to decode obfuscated commands or payloads directly into memory for execution, bypassing disk-based detection.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary code execution.
This rule detects the execution of the 'make' command with a '-f' flag pointing to a makefile located in common temporary or writable directories. This behavior can be indicative of an adversary attempting to execute arbitrary commands or escalate privileges by leveraging the 'make' utility to process a malicious makefile from a non-standard location.
Detects php/perl/ruby one-liner execution patterns combined with network or shell invocation primitives, consistent with trusted interpreter abuse and execution guardrail bypass.
This rule detects the execution of the 'awk' command on Linux/Unix systems when it is used with specific command-line arguments that indicate indirect shell execution.
For example, using environmental variables where an attacker modifies the environment variable to point to a malicious binary.
For example, using environmental variables where an attacker modifies the environment variable to point to a malicious binary.
This rule detects the execution of hidden shell scripts (files starting with a dot) within the /tmp/ or /var/tmp/ directories on Linux systems, specifically when initiated using `nohup`. This behavior is often associated with malware or post-exploitation activities to maintain persistence or execute malicious payloads discreetly. The rule looks for process execution events where the command line includes `nohup` and references a hidden `.sh` file in a temporary directory.
Detects suspicious execution of `wget` or `curl` attempting to retrieve a payload named exactly `/.shell`. This activity is indicative of the Masjesu botnet's C2 download pattern, where it attempts to download a bash shell file after exploiting a target to initiate device infection and propagation routines.
Detects suspicious execution of wget or curl retrieving a payload named exactly '/.shell', which matches Masjesu's C2 download pattern. After successfully exploiting a target, the botnet attempts to retrieve this bash shell file to initiate device infection and propagation routines.
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.
Detects suspicious interactive bash as a parent to rather uncommon child processes
Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.
Detects execution of a base64 decoded payload piped directly into the zsh shell. This technique is highly indicative of ClickFix social engineering campaigns, where users are manipulated into copying and pasting malicious one-liners into their macOS terminal to bypass Gatekeeper and execute malware such as AMOS.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
This rule detects suspicious activity involving multiple POST requests to Livewire update endpoints on web servers, followed by the spawning of unusual processes from web server parent processes (php, apache, httpd, nginx, php-fpm). The spawned processes of interest include various shells (sh, bash), command-line tools (curl, wget, python, perl, nc), or commands containing base64 encoding, chmod +x, or /tmp/ paths. This behavior could indicate a web shell compromise or successful exploitation leading to command execution.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
This rule detects the execution of hidden shell scripts within the `/tmp/` directory on Linux systems, specifically looking for `nohup` commands that launch a shell (`sh` or `bash`) to execute a hidden `.sh` file (e.g., `.eba9ee1e4.sh`). This behavior is indicative of the UAT-10608 / React2Shell threat, often associated with credential harvesting operations.
Detects the installation or execution of compromised npm packages related to the Axios supply chain attack, with execution or reference to the dropped macOS RAT payload.
Detects execution of BRICKSTORM malware components including BRICKSTEAL credential harvester, pg_update, vmp utilities, and SLAYSTYLE tools used in vSphere infrastructure attacks.
Page 37 of 45