Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,266 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,028
2,539
1,076
1,048
928
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,335
1,318
902
884
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
Detects instances where an attacker attempts to interact with or exploit a REDIS service running on an OpenCanary honeypot. This indicates reconnaissance or an attempt to gain unauthorized access or extract data from the emulated Redis service.
Detects instances where a MySQL service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to gain unauthorized access to the honeypot's emulated MySQL service, which can be a sign of reconnaissance or credential stuffing activities.
This rule detects when a Git clone request is made to a Git service running on an OpenCanary honeypot. This indicates an adversary is interacting with the honeypot, likely attempting to collect information or test access.
Detects instances where an SMB service on an OpenCanary honeypot node has received a file open request. This indicates an adversary is interacting with the honeypot's SMB share, potentially attempting to discover or access files.
This rule detects when an OpenCanary honeypot receives a Session Initiation Protocol (SIP) request. OpenCanary is a honeypot designed to detect unauthorized activity by mimicking vulnerable services. A SIP request to an OpenCanary node indicates that an attacker or scanner has interacted with the emulated SIP service, which is typically an indicator of reconnaissance or an attempted attack against voice-over-IP (VoIP) infrastructure.
This rule detects a suspicious sequence of events: a process launching with a low prevalence executable (meaning it's rarely seen in the environment) followed by that same process initiating an HTTP connection to a low prevalence domain (a domain rarely accessed in the environment) within a 10-minute window. This combination can indicate the execution of novel or custom malware attempting to establish command and control or exfiltrate data to an unusual destination.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
DNS query to a recently created domain
Detects when a low prevalence hash is seen during a process launch event, and a low prevalence domain is accessed within 10m.
Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
Detects instances where an SIP service on an OpenCanary node has had a SIP request.
Detects instances where a TFTP service on an OpenCanary node has had a request.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
This rule detects the Helldown ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files for encryption, the encryption process itself, dropping a ransom note, and attempting to kill virtual machines. The rule specifically targets ELF executables, indicating it's designed for Linux systems.
This rule detects the PygmyGoat backdoor on Linux systems by identifying specific byte patterns associated with its functionality. The patterns include code for creating backdoor sockets, forwarding data, the main constructor, and hooking the accept function, indicating the presence and activity of the PygmyGoat malware.
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the execution of a shell as a sub-process of "rsync" without the expected command line flag "-e" being used. This behavior is commonly associated with attempts to exploit CVE-2024-12084, leading to arbitrary command execution or privilege escalation.
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Yara rule that detects PygmyGoat backdoor.
Page 333 of 346