Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system. Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging. Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Detects the execution of a malicious Linux payload, possibly within a .desktop file, a technique used by APT36. The rule identifies a bash process executing an inline command that downloads and runs a payload, often using a combination of curl, xxd, base64, and eval.
Detects the execution of a shell script downloaded via curl or wget on macOS, a technique associated with ClickFix campaigns delivering malware like Atomic macOS Stealer (AMOS).
Detects potential GTFOBins abuse on Linux systems where a root shell is spawned by a suspicious parent process (e.g., find, perl, vim, tar, etc.).
This rule relies on DeviceProcessEvents in Microsoft Defender XDR and is intended for environments where Auditd, Sysmon for Linux, or similar native logging is not available.
Note: This detection does not cover all GTFOBins. It focuses specifically on cases where:
- A root-owned shell is spawned
- The parent process is known to be capable of shell escape or privilege abuse
- The child command appears interactive or escape-like
It does not detect:
- Non-shell-based GTFOBin techniques (e.g., file exfiltration via scp, curl, etc.)
- GTFOBin usage that doesn't result in a new shell (e.g., privilege escalation via
misconfigured capabilities)
- Abuse of GTFOBins run under non-root accounts
The query includes logic to detect both high-signal exploitation patterns and suspicious shell spawns, while excluding common false positives (e.g., package post-install scripts and benign environment checks).
This rule relies on DeviceProcessEvents in Microsoft Defender XDR and is intended for environments where Auditd, Sysmon for Linux, or similar native logging is not available.
Note: This detection does not cover all GTFOBins. It focuses specifically on cases where:
- A root-owned shell is spawned
- The parent process is known to be capable of shell escape or privilege abuse
- The child command appears interactive or escape-like
It does not detect:
- Non-shell-based GTFOBin techniques (e.g., file exfiltration via scp, curl, etc.)
- GTFOBin usage that doesn't result in a new shell (e.g., privilege escalation via
misconfigured capabilities)
- Abuse of GTFOBins run under non-root accounts
The query includes logic to detect both high-signal exploitation patterns and suspicious shell spawns, while excluding common false positives (e.g., package post-install scripts and benign environment checks).
Detects the CloudedHope malware, a 64-bit ELF RAT written in Golang. This malware is used by the China-nexus adversary MURKY PANDA and may be obfuscated with garble.
Detects potential Remote Code Execution (RCE) on a FortiWeb device, possibly related to CVE-2025-25257. The rule correlates a suspicious web request to a potential 'fabric' endpoint with a subsequent shell or utility process launch by the web server process on the same device.
Detects a file being created in a temporary macOS directory, made executable, and then executed by a shell. This behavior is consistent with the Odyssey Infostealer, which downloads and runs scripts from temporary locations.
Detects payloads associated with the exploitation of GeoServer vulnerability CVE-2024-36401. This rule identifies both the initial shell script downloaders and the subsequent Dart-based ELF executables.
Detects the RustDoor malware for macOS. This backdoor, written in Rust, is used by North Korean threat actors to target software developers in the cryptocurrency sector. It often masquerades as a legitimate software update or component.
Detects the NoDepDNS backdoor, a Golang-based implant used by the CL-STA-0969 threat actor. It passively listens on UDP port 53 for DNS queries and executes XOR-encoded commands embedded in the IP address responses.
Detects the use of the 'mdimport' command to index sensitive user directories. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where a malicious Spotlight importer is triggered to run within the 'mdworker' process and exfiltrate data from TCC-protected locations by writing it to the system log.
This detection identifies when the ESXi Shell is enabled on a host, which may indicate that a malicious actor is preparing to execute commands locally or establish persistent access. Enabling the shell outside of approved maintenance windows can be a sign of compromise or unauthorized administrative activity.
This detection looks for reverse shell string patterns on an ESXi host, which may indicate that a threat actor is attempting to establish remote control over the system. It specifically identifies patterns commonly used in bash, python, and other shell commands to initiate reverse connections.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
Detects TTPs and IOC´s associated with a cryptomining campaign that exploits exposed Java Debug Wire Protocol (JDWP) services. Attackers gain remote code execution to download and execute a dropper script (`logservice.sh`), which in turn deploys a modified XMRig miner disguised as `logrotate`. The malware establishes persistence through multiple methods, including systemd services, cron jobs, and shell startup scripts.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
KQL Query from file: ClickFix social engineering attack detection
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query
Detects the use of GCC (or C89/C99) with the '-wrapper' option to execute a shell, which can be leveraged for privilege escalation, unauthorized command execution, or to break out from restricted environments. This technique is often documented in resources like GTFOBins.
Page 42 of 45