Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
308 detections
Filters
Last updated
All Time
Detection languages
96
92
44
29
15
Contributors
79
59
56
38
35
Categories
109
103
65
63
55
Platforms
234
91
43
28
8
Products / Services
10,670
9,758
6,693
4,421
3,749
308
MITRE Techniques
112
87
84
68
66
CVEs
3
3
2
2
2
IDS Classtypes
51
33
6
2
2
IDS Protocols
94
1
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Detects a root SSH sign-in from a public IP address or known attacker IP, followed within 30 minutes by a write or modification to the root authorized_keys file on the same device.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects non-root SSH execution performing remote port forwarding (-R) targeting a Unix socket bind on hosts running the tailscaled daemon, excluding known automation tools.
Detects potential SSH agent hijacking where process command line activities reference SSH authentication sockets or environment variables, followed closely by a successful SSH connection to a remote host from the same device.
Detects evidence of exploitation and post-exploitation activity related to CVE-2026-59310, an unauthenticated RCE vulnerability in the VMware vCenter Syslog Server. The rule monitors for suspicious child processes spawned by vmsyslogcollector, directory traversal patterns in command lines, and persistence mechanisms involving SSH authorized_keys modification, cron job creation, or systemd unit deployment on the VCSA shell.
This rule monitors Linux system authentication logs to identify potential unauthorized access attempts. It triggers when a single source IP initiates a high volume of failed SSH login attempts (brute force) or when a single user account is targeted by multiple distinct source IPs within a short time window (password spraying).
Detects potential misuse of SSH credentials by identifying successful SSH logins from source IP addresses that have not been observed in the previous 14 days, or successful SSH logins occurring within one hour of an authorized_keys file modification on the same host. This combination of behaviors is indicative of an adversary establishing or using persistence via SSH key manipulation.
This rule detects potential brute-force activity against remote access services (OpenVPN, StrongSwan, WireGuard, and SSH) on Linux hosts by monitoring Syslog for patterns indicating repeated failed authentication attempts. It further highlights instances where a burst of failed attempts is followed by a successful authentication for the same source IP, indicating a potential successful compromise.
Detects repeated SSH authentication failures originating from an external source on port 22, where the username pattern appears to be programmatically generated or enumerated (e.g., username followed by digits). This behavior is characteristic of automated brute-force attempts targeting common SSH services.
Detects the creation or modification of SSH authorized_keys or authorized_keys2 files. This is a common persistence technique used to maintain remote access by adding an adversary-controlled public key to a user's configuration, often performed after initial access through exploitation of public-facing services.
This rule identifies suspicious post-exploitation activity where an anomalous or unauthenticated NetScaler VPN session (potentially exploiting CVE-2026-88771 or CVE-2026-88772) is followed by the creation or modification of SSH authorized_keys files or related credential manipulation commands on internal hosts, suggesting an attacker establishing persistence.
Detects configuration changes to AAA/TACACS+ settings or the creation of local administrative accounts on network devices executed over SSH or Telnet sessions. This behavior is associated with malicious activity by groups such as Salt Typhoon, involving the compromise of telecommunications infrastructure.
Detects the execution of the 'fanout.sh' utility from the /tmp directory, which subsequently spawns 'sshpass' child processes to perform rapid, non-interactive SSH authentication attempts ('StrictHostKeyChecking=no') against multiple internal hosts within a 10-minute window. This behavior is indicative of automated lateral movement, specifically observed by threat actor UNC6240.
Detects potential misuse of SSH credentials by identifying successful SSH logins from source IP addresses that have not been observed in the previous 14 days, or successful SSH logins occurring within one hour of an authorized_keys file modification on the same host. This combination of behaviors is indicative of an adversary establishing or using persistence via SSH key manipulation.
Detects unauthorized modifications to the .ssh/authorized_keys file. Such changes are often performed by adversaries to establish persistence by ensuring their own public keys allow them remote access to the host. The rule filters out known configuration management and system tools to reduce noise.
Detects high-volume SSH authentication failures from a single source IP address within a short time frame, which is indicative of credential spraying or brute force activity.
Page 1 of 15