Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
68 detections
Filters
Last updated
All Time
Detection languages
24
16
8
4
4
Contributors
22
5
4
4
4
Categories
38
32
31
17
9
Platforms
60
6
6
4
1
Products / Services
27
10
10
5
5
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
3
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects processes launched with LD_AUDIT or LD_DEBUG style dynamic linker instrumentation, sometimes used to weaken execution guardrails or enable stealthy code paths.
Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.
Detects the ld.so preload persistence file. See `man ld.so` for more information.
Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.
This rule detects artifacts associated with the Auto-Color Linux backdoor. Specifically, it looks for the presence of the malicious library 'libcext.so.2', which mimics a legitimate library, or modifications to '/etc/ld.preload' for persistence and dynamic linker hijacking. It also identifies specific file paths used by the malware, such as '/var/log/cross/auto-color' or files within '/tmp/cross/' with a 'config-err-' prefix.
This rule detects the presence or execution of files identified by specific SHA256 hashes or file names associated with PAM-based backdoors on Linux systems. It monitors device events, file events, process events, and image load events for these indicators. The rule aims to identify the 'Plague' PAM-based backdoor or similar malicious PAM modules.
Detects suspicious cron job executions or the execution of a potentially trojanized 'crontab' binary. Adversaries, as seen with malware like Perfctl, may replace or modify the 'crontab' utility to hide malicious scheduled tasks from administrators. This detection looks for common patterns of malicious cron jobs.
This rule set detects indicators of compromise associated with the RESURGE activity targeting Ivanti Connect Secure devices, as described by CISA. It looks for specific file hashes, the presence of a covert socket path (.logsrv), and modifications to key Ivanti filesystem artifacts such as LD_PRELOAD, DSUpgrade.pm, coreboot.img, and scanner.py. A match indicates potential compromise and requires further investigation to confirm the asset role, timing of file appearance, and comparison with approved maintenance windows. If hits are found, collect logs and file copies, reduce external exposure, and look for unusual activity like unexpected administrator actions or unfamiliar outbound connections.
Detects the presence of files matching the SHA256 hashes of known RESURGE malware components, including the main 'libdsupgrade.so' library, the 'liblogblock.so' log tamperer, and the 'dsmain' utility. This rule identifies the creation or modification of these specific files on a device.
Detects the telnetd process spawning child processes with highly suspicious environment variables, such as a modified PATH or LD_PRELOAD. This can indicate an attempt to hijack execution or move laterally, and is a technique associated with CVE-2026-24061.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
Detects the LANDFALL Android spyware manipulating SELinux policy by preloading a malicious shared object and passing a path to the 'l.so' policy manipulator component via the PRELOAD_PATH environment variable.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects the LANDFALL Android spyware manipulating SELinux policy by preloading a malicious shared object and passing a path to the 'l.so' policy manipulator component via the PRELOAD_PATH environment variable.
This rule identifies modifications to the `/etc/ld.so.preload` file. This file is used by the Linux dynamic linker to specify shared libraries that should be loaded before any other libraries. Attackers can modify this file to inject malicious shared objects into processes, enabling privilege escalation, persistence, or defense evasion by loading arbitrary code.
This rule detects the creation or modification of the `/etc/ld.so.preload` file. This file is used by the dynamic linker (`ld.so`) on Linux systems to specify shared libraries that should be loaded before any other libraries. Adversaries can leverage this mechanism for persistence, privilege escalation, or defense evasion by preloading malicious libraries, effectively hijacking legitimate functions. Refer to `man ld.so` for more details on its functionality.
This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. These files typically facilitate process hiding, credential theft, and backdoor access. Monitoring for such file creation patterns enables early detection of rootkit deployment before full compromise.
This YARA rule detects the Pumakit rootkit on Linux systems. It identifies specific byte patterns associated with the rootkit's syscall hooking mechanisms, including patterns related to hooking `rmdir` and `gdents64` functions. The rule looks for these distinct code sequences within executable files to indicate the presence of the Pumakit rootkit.
KQL Query from file: Threat Hunting BYOVD Scenarios
Page 3 of 4