Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects potential exploitation of CVE-2026-8461 (PixelSmash) where an attacker hijacks the AVBuffer.free function pointer in media processing software (ffmpeg, ffprobe, etc.) to trigger arbitrary code execution via a spawned shell process.
Detects unauthorized modifications to SSH authorized_keys files and changes to SSH configuration (specifically PermitRootLogin) on Cisco SD-WAN controllers, which may indicate persistence or unauthorized remote access attempts.
Detects indicators of exploitation attempts for the libssh2 pre-auth heap RCE vulnerability (CVE-2026-55200). The rule monitors for the execution of known harness binaries, abnormal child processes spawned by sshd, unauthorized file creation in sensitive temporary directories, and the loading of libssh2 libraries from non-standard, writable locations.
This rule identifies suspicious command-line activity indicative of log manipulation, truncation, or deletion on Cisco SD-WAN controllers. It monitors for the execution of utilities like 'rm', 'shred', 'truncate', 'bash', 'cat', and 'echo' targeting critical system logs, including '/var/log/auth.log' and various 'vdebug' log files. By detecting these anti-forensic techniques, the rule flags potential attempts by adversaries to conceal post-exploitation activity or clear audit trails.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
Detects signs of HTTP request smuggling attempts targeting nghttpx or similar proxies. The rule monitors for a specific poisoning precondition where an HTTP/1.1 Upgrade request contains both an 'Upgrade' header and a 'Content-Length' header, which can be leveraged to desynchronize the connection and smuggle subsequent requests (e.g., GET /poisoned).
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
This rule monitors for the presence of known exploit harness binaries associated with CVE-2026-55200 on disk or in command lines, and identifies post-exploitation activity where common network utilities (curl, git, php) execute unsigned or suspicious child processes, which often indicates lateral movement or payload staging.
Detects the execution of the fscan network scanner binary, its use with common scanning arguments, or any network communication with the known staging IP address associated with the fscan deployment.
Detects multiple techniques associated with Linux post-exploitation and persistence, including LD_PRELOAD environment variable hijacking, suspicious cron jobs, profile.d persistence modifications, systemd service masquerading via prctl, and fileless execution via memfd_create.
Detects execution of the tc (traffic control) utility with pedit actions by non-root users. This pattern is indicative of exploitation attempts targeting the Linux kernel act_pedit subsystem (CVE-2026-46331), which can lead to page cache corruption and local privilege escalation.
Detects the malicious execution of the Bun JavaScript runtime associated with the Miasma supply chain attack. The rule identifies suspicious child processes spawned from development directories (like node_modules) that execute Bun to read sensitive configuration files, SSH keys, and cloud credentials typically targeted for exfiltration.
This rule detects the creation of directories or files within /var/tmp that use the hidden naming convention (dot-prefix), specifically looking for '.xlamb' or '.x'. Such hidden directories in temporary storage locations are commonly used by attackers for staging malicious tools, malware, or backdoors.
Detects download, execution, and network activity associated with the 'isp.sh' dropper script. This includes the use of common utilities like curl or wget to fetch the script from a specific C2 IP address (83.142.209.214), piping the script directly to a shell, and signs of secondary payload execution such as 'lambsys'.
Detects attempts to disable or modify critical Linux security subsystems including SELinux and AppArmor. The rule monitors for the execution of commands such as setenforce, aa-teardown, and systemctl, or direct modifications to security configuration files.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Detects the abuse of SAP RFC function modules SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT to execute arbitrary OS commands. This activity, observed in the Operation Escaneo campaign, indicates potential unauthorized system command execution via SAP application components, often leveraging specific ZREDTEAM modules or scripts.
This rule detects potentially malicious activity within Oracle database audit and alert logs, specifically monitoring for the usage of packages like DBMS_SCHEDULER or UTL_FILE to execute OS commands or manipulate files. It also flags the execution of known exploit scripts or reconnaissance queries commonly associated with database-based attacks and unauthorized data dumping.
Page 35 of 51