Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects attempts to use outdated or weak cryptographic algorithms and protocols by monitoring command-line arguments of common network and cryptographic utilities. Specifically, it looks for the use of RC4, DES, 3DES, RSA1024, MD5 ciphers, or TLS 1.0, TLS 1.1, and SSL 3.0 protocols, as well as the '--insecure' flag, when executed by applications like openssl, gpg, ssh, or curl. This could indicate an adversary attempting to downgrade cryptographic protections to facilitate eavesdropping or other attacks.
This rule detects the creation of specific JSP web shell filenames (1.jsp, 401.jsp, 403.jsp) and suspicious CSS files in the Ivanti EPMM web application directory. This activity is indicative of post-exploitation persistence following the exploitation of vulnerabilities like CVE-2026-1281 or CVE-2026-1340.
This detection identifies the use of the 'kill' command with a specific, non-standard real-time signal (-59). Rootkits like 'Singularity' use these 'magic' signals as an out-of-band communication channel to trigger actions within a malicious kernel module, such as toggling stealth features or granting root privileges.
This rule detects inbound SSH connections originating from external IP addresses to systems running SSH services. It specifically looks for successful incoming network connections where the destination port is commonly associated with SSH (22, 222, 2222, 8022) or the source process name is an SSH daemon (sshd, dropbear). The rule explicitly excludes connections from private IP ranges and certain common web server processes on standard web ports to reduce false positives. The threat model includes unauthorized external SSH access, brute-force/credential-stuffing attacks, backdoor SSH daemons, compromised servers accepting attacker sessions, and reverse shell callbacks.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
This rule set looks for signs linked to the Shadow Campaigns espionage group. It flags the use of their loader, checks for connections to known servers they have used, spots fake security software used as bait, and highlights suspicious activity coming from web server processes that may indicate a hidden backdoor.
This rule detects the execution of bash or sh scripts that contain specific keywords associated with the OpenClaw installation process. It looks for command lines that include "openclaw" along with other distinctive strings such as "run_remote_bash", "OPENCLAW_INSTALL_SH_NO_RUN", "OPENCLAW_USE_GUM", "All your chats, one OpenClaw", ".openclaw/openclaw.json", or "openclaw.ai/install.sh". This aims to identify potential OpenClaw installation attempts, even if the script itself has been renamed.
Detects command injection related attacks with AI agents through suspicious prompt patterns or system command execution by AI processes.
This rule detects outbound SSH (Secure Shell) connections initiated by common SSH client executables (ssh.exe, ssh, plink.exe, dbclient.exe) to external IP addresses. It explicitly excludes connections to common private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the loopback address (127.0.0.0/8) to reduce false positives from internal network activity.
Detects suspicious web requests to the Tomcat Manager on Dell RecoverPoint appliances. This technique is used by UNC6201 to exploit CVE-2026-22769 and upload malicious WAR files.
Detects the creation of JSP web shells or suspicious CSS files in the specific directory used by Ivanti EPMM for application distribution, a common post-exploitation step observed in this campaign.
Detects suspicious child processes (e.g., shells, network utilities) spawned by the Ivanti EPMM web server process (java, tomcat, httpd). This behavior is a strong indicator of successful remote code execution, often following the exploitation of vulnerabilities like CVE-2026-1281 and CVE-2026-1340.
This detection identifies modifications to the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This script is executed at boot time and was observed being modified by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.
This rule detects suspicious Python command-line executions that involve importing the 'requests' library, using 'exec()' for dynamic code execution, and making HTTP/HTTPS requests. This pattern is often observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects modification of the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This technique is used by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.
The following rule detects attempts to tamper with Linux log records by looking for interpreter processes, or common utility commands interacting with critical log files such as /var/log/wtmp, /var/log/btmp, or /var/run/utmp. It also includes scenarios where 'dd' or 'cp' might be used with /dev/null or /dev/zero to effectively clear or overwrite log content.
This rule detects Python scripts that use base64 decoding and execution, specifically looking for the 'import base64' statement appearing early in the file, followed by 'exec(base64.b64decode(' and ').decode('utf-8'))'. This pattern is indicative of a common method for obfuscating and executing malicious Python payloads, often seen in malware like KongTuke.
This detection identifies the execution of iptables commands used to implement Single Packet Authorization (SPA). This technique was observed being used by UNC6201 on compromised VMware appliances to create stealthy, conditional network proxies for C2 traffic. The rule looks for specific command-line arguments indicative of SPA setup, including rules for 'magic packet' detection, dynamic IP list management using the 'recent' module, and traffic redirection.
Sleeper-style JSP backdoor: 403.jsp or similar with Runtime.getRuntime().exec or ProcessBuilder
This rule set detects attempts to download an 'install.sh' script from the domains 'clawd.bot' or 'openclaw.ai' using various methods. The first rule, 'openclaw_curl_install_script', specifically targets command-line tools like curl, wget, aria2c, and fetch. The 'openclaw_powershell_download' rule focuses on PowerShell commands (Invoke-WebRequest, iwr, Invoke-RestMethod, irm) used for downloading. The 'openclaw_aria2c_fetch_download' rule is redundant with the first rule, as it also targets aria2c and fetch. The 'openclaw_lolbin_download' rule identifies the use of Living Off The Land Binaries (LOLBins) such as certutil, bitsadmin, and mshta for the same download activity. Finally, the 'openclaw_http_install_sh' rule detects direct HTTP network requests to the 'install.sh' path on these domains. Collectively, these rules aim to identify potential initial access or execution attempts involving a suspicious installation script from specific domains.
This rule detects the execution of a bash or sh script that contains multiple identifiers related to OpenClaw installation. It specifically looks for command lines ending with '/bash' or '/sh' and containing 'openclaw', combined with additional OpenClaw-specific strings such as 'run_remote_bash', 'OPENCLAW_INSTALL_SH_NO_RUN', 'OPENCLAW_USE_GUM', 'All your chats, one OpenClaw', '.openclaw/openclaw.json', or 'openclaw.ai/install.sh'. This content-based detection aims to identify OpenClaw install script execution even if the script is renamed.
Page 301 of 347