Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers.
Detects potential credential theft activity where a user or compromised process executes shell commands to inspect environment variables, AWS credential files, or project configuration files (e.g., .env) for sensitive secrets such as API keys and access tokens.
Detects common patterns of post-exploitation activity including downloading scripts (isp.sh) via curl/wget, executing shell commands to fetch remote payloads, running suspicious binaries from temporary directories like /var/tmp or /tmp, and persistent execution patterns.
Detects attempts to disable or flush system firewall rules on Linux platforms using common utilities like iptables, ufw, or nftables. Adversaries perform these actions to bypass network access controls and facilitate malicious activities such as command and control communications or lateral movement.
Detects reconnaissance activities associated with the MYRA RAT, specifically the enumeration of network connections by reading /proc/net/tcp and /proc/net/udp, originating from the systemd-userdbd process. This behavior is indicative of malware attempting to map network state via proc filesystem parsing.
Detects the use of sshpass to perform credential spraying against specific PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule triggers when sshpass is executed with disabled host key checking or batch mode, indicating automated, non-interactive authentication attempts.
This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.
This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Detects unauthorized execution of SAP RFC exploitation scripts that leverage SXPG_CALL_SYSTEM or SXPG_COMMAND_INSERT to inject and execute OS commands. This behavior is associated with exploitation tactics targeting SAP environments, specifically identified by the presence of custom ZREDTEAM artifacts and known malicious script naming conventions.
This rule detects the use of 'chmod' or 'chown' commands on critical system directories ('/etc', '/bin', '/usr', '/sbin') on Cisco vManage, vSmart, and vEdge networking appliances. Such activity could indicate unauthorized modification of system files, persistence attempts, or privilege escalation by an adversary targeting the networking infrastructure.
Detects indicators of the MYRA Linux RAT, including fileless execution via memory-based techniques (memfd_create/fexecve), process masquerading as systemd-userdbd, and persistence mechanisms leveraging LD_PRELOAD and malicious cron jobs.
Detects a multi-stage infection sequence characteristic of common IoT botnets (such as Mirai variants). The detection triggers when a sequence of events occurs on the same device within a 5-minute window: downloading a file from a URL using wget or curl to /tmp/, modifying the file permissions using chmod 777, and subsequently executing the binary. An optional cleanup phase involving removal of files from /tmp/ is also correlated.
Detects common anti-forensic staging patterns used by IoT botnets such as TerraBot, r00ts3c, and RondoDox. The rule identifies processes that stage payloads in the /tmp directory, set world-writable execution permissions (chmod 777), and immediately delete artifacts following execution to hinder forensic analysis.
Detects the use of esxcli or vim-cmd commands on VMware ESXi hosts to power off virtual machines, remove software components (VIBs), or enable maintenance mode. These actions are commonly performed by the Akira ransomware group to disrupt operations and facilitate encryption.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.
Detects the execution of the Linux 'tc' (traffic control) utility with 'act_pedit' by an unprivileged (non-root) user. This pattern is associated with attempts to leverage the CVE-2026-46331 vulnerability, which involves a Copy-on-Write (COW) kernel exploit triggered through malicious netlink operations in the traffic control subsystem to achieve privilege escalation.
Detects execution of known Proof-of-Concept binaries (pedit_cow_demo or packet_edit_meme) followed by /bin/su spawning /bin/sh, which indicates successful exploitation of the pedit COW vulnerability resulting in shellcode execution with root privileges.
Detects the creation of a specific ransom note file associated with ShinyHunters activity within PeopleSoft web or application server configuration directories.
Detects the deployment of MeshCentral remote management agents and associated outbound communication to suspicious C2 infrastructure, identified in environments compromised by ShinyHunters. This rule monitors for specific process execution patterns involving meshctrl.js and meshagent, alongside network connections to known C2 domains and IP addresses.
Page 38 of 51