Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects the execution of Dropbear SSH binaries (dropbear, dropbearkey, dropbearmulti) on identified OT, ICS, or SCADA assets. The rule flags suspicious configurations such as the use of non-standard ports (2222, 44818), remote port forwarding, or running in the foreground, which may indicate unauthorized remote access or tunneling on sensitive operational technology infrastructure.
Detects the spawning of /bin/sh or /bin/bash as a direct child process of ffmpeg, jellyfin, or nextcloud. This behavior is often indicative of exploitation attempts against these media and storage services, potentially leveraging remote code execution vulnerabilities.
Detects unauthorized execution of MeshCentral's meshctrl.js to interface with a local WebSocket endpoint on PeopleSoft servers, likely indicative of session hijacking post-exploitation of CVE-2026-35273 by the ShinyHunters threat group.
Detects the suspicious combination of 'aa-exec' (commonly associated with AppArmor or specific container runtime wrappers) being followed by the execution of 'unshare' with flags used to manipulate kernel namespaces (user, network). This pattern is often indicative of container breakouts or privilege escalation attempts where an adversary leverages namespace isolation to gain higher privileges on the host.
Jellyfin Ffprobe Exploit
YARA-L
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects unauthorized cron job creation or modification associated with cryptominer persistence. The rule monitors for common persistence indicators such as referencing 'lambsys', 'isp.sh', or 'procq' within cron-related commands and shell execution patterns that suggest malicious automated tasks in Linux environments.
This rule detects potentially malicious shell execution (e.g., bash -i, /dev/tcp/ reverse shells, netcat) spawned directly or indirectly by common media processing applications such as ffmpeg, ffprobe, jellyfin, or nextcloud. It identifies when these applications initiate shell processes or execute command lines that exhibit suspicious behavior or access specific media-related paths commonly targeted for abuse.
Detects unauthorized modifications to cron jobs or RC scripts on Linux and BSD edge appliances, which is a persistence technique observed in the VerdantBamboo BRICKSTORM campaign. The rule flags suspicious file modifications in persistence-related directories, excluding activity from legitimate package managers.
This rule detects suspicious use of sudo, modification of the sudoers file, or privilege escalation patterns specifically targeting edge network appliances (e.g., pfSense, Synology, Egnyte). It monitors for commands like sudo tee, sudo -l for permission enumeration, or the introduction of NOPASSWD entries, which are common indicators of persistence or privilege escalation attempts by service accounts.
Detects the unauthorized exfiltration of SSL private key files using Netcat to a known malicious C2 IP address (62.171.185.97). The rule monitors process execution commands that include specific file names associated with certificate harvesting or extraction tools being piped or transmitted over the network.
Detects evidence of the MYRA RAT attempting to establish persistence via the LD_PRELOAD environment variable. This is achieved by creating or modifying malicious shared libraries (e.g., .libcache.so) and configuring system startup files (e.g., /etc/profile.d/.sh.local) to ensure the library is loaded by the dynamic linker on startup.
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
This rule monitors for signs of Atlas RAT activity on Linux systems, including the execution of processes matching known Atlas RAT naming conventions, unauthorized modifications to system persistence mechanisms (systemd or init.d directories) by non-package management utilities, and anomalous outbound network connections originating from sshd or PAM-related processes.
Detects suspicious behavior involving the 'uptime' system utility, including execution from non-standard paths, unexpected outbound network connections, spawning child processes, or replacement of the legitimate /usr/bin/uptime binary. These behaviors are indicative of masquerading or binary hijacking.
This rule monitors Linux authentication logs for anomalies related to Pluggable Authentication Modules (PAM). It identifies potential security risks by detecting file operations (read, write, create) within PAM-related processes, references to world-writable or temporary directories that may be used for staging credentials, and unusual authentication event patterns.
Detects instances of the 'smbd' process executing from non-standard locations or initiating network connections on ports other than the default SMB ports (139, 445), which may indicate a rogue service, masquerading, or network pivoting activity.
Detects the execution of known GSocket/GS-Netcat tools or the usage of the 'uptime' command when accompanied by network activity, which may indicate process masquerading.
This rule detects potential persistence mechanisms on Linux systems by identifying the creation of new systemd service files, modifications to init.d scripts, or the use of systemctl to enable or start services. The rule specifically excludes standard package management activities (apt, yum, dnf, dpkg) and flags if the triggered service operation involves suspicious file paths.
Page 33 of 51