Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects attempts to disable or flush system firewall rules on Linux platforms using common tools like iptables, ufw, firewalld, and nftables. Adversaries often perform these actions to bypass network controls and facilitate unauthorized communication.
This rule detects a multi-stage Linux privilege escalation exploitation sequence often associated with kernel vulnerabilities (such as CVE-2023-32233). It identifies: 1) The creation of a user namespace to acquire CAP_NET_ADMIN privileges, 2) The use of 'tc' (traffic control) with 'pedit' actions by a non-root user, 3) The loading of the 'act_pedit' kernel module by a non-root user, 4) Execution of known proof-of-concept binaries (e.g., PACKET_EDIT_MEME, pedit_cow_demo), and 5) Post-exploit evidence cleanup involving the clearing of system page caches via 'drop_caches'.
Detects suspicious command-line activity indicative of an adversary attempting to disable security controls (such as SELinux, AppArmor, UFW, and IPTables) or performing cleanup and maintenance tasks on suspected cryptominer-related files on a Linux system.
Detects suspicious activity originating from web application processes (python, uvicorn, gunicorn) involving the download and execution of a payload (isp.sh), followed by the deployment and execution of a binary (lambsys) within hidden directories in /var/tmp/. This rule flags indicators of compromise such as curl/wget calls to suspicious IPs, creation of hidden directories, and execution of binary files in temporary storage locations.
This rule detects potential exploitation of the DirtyClone vulnerability (CVE-2026-43503) by correlating prerequisites (XFRM state/policy creation, specific kernel module loading, or namespace manipulation) with a subsequent local privilege escalation where an unprivileged process spawns a root shell using 'su'.
Detects coordinated security defense evasion activities by the Lambsys cryptominer campaign. The rule triggers when a shell process (bash, sh, or dash) is used to stop or disable security services (auditd, ClamAV, osquery, Falco, CrowdStrike Falcon), forcibly terminate their processes using pkill or kill -9, and delete or shred critical system security and audit logs (auth.log, syslog, audit).
This rule detects attempts to tamper with critical Linux log files such as /var/log/auth.log, /var/log/syslog, and /var/log/audit/audit.log. It specifically looks for file deletion or modification events, or process creation events that involve commands like 'rm', 'shred', 'truncate', 'unlink', or 'dd' targeting these log files. Legitimate processes like 'logrotate', 'rsyslog', 'syslog-ng', 'auditd', 'systemd', and 'journald' are excluded to reduce false positives.
This rule monitors for suspicious activity on Linux-based SD-WAN appliances (e.g., vManage, vBond, vSmart) including unauthorized file deletion, log tampering, and credential backup manipulation. It specifically flags operations like removing system logs, deleting configuration/tenant files, or copying sensitive files like /etc/passwd and /etc/shadow, which are common indicators of post-exploitation activity or attempts to hide malicious footprints.
Detects attempts by a user or process to clear audit logs, system logs, or command history, often used by adversaries to cover their tracks on a compromised system. The rule monitors for file deletion (rm, shred), content truncation (truncate), selective line removal (sed -i), and shell history suppression (HISTFILE=/dev/null, history -c) against sensitive log and history paths.
This rule detects potential rogue SD-WAN peering attempts by correlating successful SSH public key authentication using 'vmanage-admin' from known malicious IPs with subsequent network activity on SD-WAN control plane ports (e.g., 48373 for OMP, 830 for NETCONF). It also flags logs containing references to an 'evil_tenant.csv' artifact, which is associated with adversary persistence or unauthorized configuration management in SD-WAN environments.
Detects unauthorized persistence mechanisms on Cisco SD-WAN management plane nodes (vManage, vSmart, vBond). The rule monitors for modifications to SSH authorized_keys files, execution of commands like ssh-keygen or user management utilities, and SSH authentication events or configuration changes (e.g., PermitRootLogin) indicative of backdoored access.
Detects multiple failed SSH login attempts from a single source IP address, indicating a potential brute force attack. The rule identifies 'Invalid user' or 'Failed password' messages in syslog from the 'sshd' process and groups them by source IP and time to count unique attempted users and total attempts. A threshold of more than 5 attempted users from a single source IP within a 10-minute window triggers an alert.
This rule detects potentially malicious activity associated with the RustDesk remote access tool. It monitors for two conditions: 1) RustDesk spawning suspicious child processes (e.g., shells, scripting engines, or network tools) that indicate post-exploitation behavior. 2) The RustDesk binary being executed from an unusual parent process, which may indicate session hijacking or unauthorized installation.
Detects unauthorized SSH-based lateral movement originating from a compromised Cisco SD-WAN vManage controller to vSmart or vBond components. The rule monitors for SSH sessions initiated by administrative users (admin, vmanage-admin) and subsequent unauthorized file permission modifications (chmod/chown) on sensitive system files and directories, such as SSH authorized_keys and system configuration files, which are indicative of post-exploitation activities.
Detects potential remote code execution (RCE) attempts leveraging a vulnerability in the Nextcloud Movie preview provider (CVE-2026-8461). The detection identifies cases where the web server service user (www-data) unexpectedly spawns ffmpeg or ffprobe, followed by the immediate spawning of a command shell from these multimedia processing binaries, which is highly anomalous.
Detects execution of AryStinger or JDY malware as a secondary payload on Oracle PeopleSoft servers, likely following exploitation of CVE-2026-35273 by ShinyHunters. The rule monitors for processes matching these names or anomalous binaries spawned from within the PeopleSoft application directory that are not part of the legitimate application service suite.
Detects anomalous network and file activity associated with the libarchive ZIP size boundary bypass vulnerability (Exploitarium PoC). The rule identifies processes like 'debuginfod' or 'curl' interacting with specific /buildid/*/section/ endpoints via loopback interfaces, correlated with the creation of known PoC marker files or logs in temporary directories.
Detects anomalous process execution where a non-privileged user attempts to execute /bin/su to transition to UID 0 (root) without a legitimate parent process (such as sudo, sshd, or login). This activity is indicative of the pedit COW (CVE-2026-46331) exploit, which involves poisoning the /bin/su page cache to achieve unauthorized privilege escalation via shellcode injection.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
Detects suspicious activity on Cisco SD-WAN infrastructure (vManage, vSmart, vBond) associated with unauthorized configuration changes, potential exploitation of CVE-2026-20245, rogue account creation, and anti-forensic behaviors.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Page 32 of 51