Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
99 detections
Filters
Last updated
All Time
Detection languages
41
23
11
10
5
Contributors
39
22
15
7
5
Categories
43
41
21
12
12
Platforms
55
48
10
4
4
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
25
23
21
18
15
CVEs
6
6
1
1
1
IDS Classtypes
3
1
IDS Protocols
4
Detects high-frequency execution of MySQL enumeration queries (such as showing databases, tables, or selecting from the information_schema) by the MySQL client process. This behavior is often associated with database reconnaissance or automated scanning during the discovery phase of an attack.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
Detects high-volume SQL UPDATE operations indicating data manipulation attack
Detects high-volume database record modifications
Detects multiple failed connection attempts to Azure Database for MySQL, which may indicate a brute force attack. This rule specifically looks for 'Access Denied' errors (error code 1045) or other non-zero error codes during connection attempts within a defined timeframe from the same client IP address.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.
Detects high-volume SQL operations indicative of data manipulation attacks
This rule detects attempts to manipulate database data on a remote MySQL server (port 3306) by identifying 'UPDATE' and 'SET' SQL commands within TCP traffic. It uses a threshold to alert on a high frequency of these commands from a single source, indicating potential malicious activity like data modification or integrity compromise.
Detects creation of malicious stored procedures in SQL databases
MySQL Database DROP TABLE Attack
Suricata
This rule detects attempts to drop tables in a MySQL database. It specifically looks for the 'DROP TABLE' string in TCP traffic directed to the standard MySQL port (3306) on the home network. This activity is often indicative of malicious intent, such as data destruction or database tampering.
This rule detects attempts to modify stored data within a MySQL database, specifically looking for 'UPDATE' and 'WHERE' clauses in TCP traffic directed to the MySQL default port (3306). It triggers an alert if 50 such events are observed from the same source IP within a 30-second window, indicating potential malicious activity aimed at data integrity compromise.
Detects the creation of a new MariaDB User-Defined Function (UDF) that loads a shared object (.so or .dll) file. This technique is used in the final stage of the CVE-2026-32710 attack chain to execute arbitrary OS commands, often from suspicious temporary or public directories.
Detects the creation of files with scripting or executable extensions by Mysql daemon.
Which could be an indicator of "User Defined Functions" abuse to download malware.
Which could be an indicator of "User Defined Functions" abuse to download malware.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The following analytic identifies the execution of RAR utilities to archive files on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line arguments. This activity is significant as threat actors, including red-teamers and malware like DarkGate, use RAR archiving to compress and exfiltrate collected data from compromised hosts. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive information to command and control servers, posing a severe risk to data confidentiality and integrity.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Page 3 of 5