Skip to content
.ca
sign in

Detection rules

YARA, Suricata, Sigma and host-hunt rules pulled from the reports. Click a rule to see the full text and every post that uses it, or pull the set as JSON via the feed. We don't serve loadable rule files by design — copy and review before you deploy.

TypeRulePostsLast seen
hostHunt for n4d cron persistence12026-07-18
hostHunt for n4d SSH persistence key12026-07-18
hostHunt for n4d login-hook persistence12026-07-18
hostHunt for n4d worm persistence artifacts12026-07-18
yaran4d_ssh_key12026-07-18
yaran4d_persistence_login_hook12026-07-18
yaran4d_persistence_updater12026-07-18
yaran4d_persistence_watchdog12026-07-18
yaran4d_agent_unpacked12026-07-18
yaran4d_agent_packed12026-07-18
suricataN4D Worm - Agent download from cdnorigin.net12026-07-18
suricataN4D Worm - Agent download from Mesh Control C212026-07-18
suricataMCP JSON-RPC initialize from external source12026-07-18
suricataIVANTI SENTRY CVE-2026-10520 MICS handleMessage POST (pre-auth RCE attempt)12026-06-21
yaraIvantiSentry_JSP_RuntimeExec_Webshell12026-06-21
yaraIvantiSentry_PHP_System_Webshell12026-06-21
hostIvantiSentry post-exploitation host hunts (CVE-2026-10520)12026-06-21
suricataATTACK Docker create body binds host root filesystem12026-06-16
suricataATTACK Docker create body uses chroot for host-namespace escape12026-06-16
suricataATTACK dockerpwn persistence script delivery in HTTP request body12026-06-16
suricataATTACK Inbound Docker Engine API container create from external source12026-06-16
suricataATTACK Inbound Docker Engine API exec/start from external source12026-06-16
suricataATTACK 'Polly for Sonya' Cyrillic-language Docker pwn tooling marker12026-06-16
suricataC2 VoidLink agent binary download (fleet-agent-linux)12026-06-16
suricataC2 VoidLink agent enrolment (POST /api/agents/enroll)12026-06-16
suricataC2 VoidLink agent WebSocket channel (GET /ws/agent)12026-06-16
suricataC2 VoidLink bootstrap fetch, token-shape key (EXPERIMENTAL)12026-06-16
suricataC2 VoidLink bootstrap install script fetch12026-06-16
hostdaemon.json.disabled-by-dockerpwn fallback artifact12026-06-16
hostdocker logs audit for PWN COMPLETE / dockerpwn12026-06-16
hostdockerpwn managed ssh marker in sshd_config12026-06-16
yaraDockerPwn_v2_Universal_Persistence_Script12026-06-16
hostDocker systemd override audit12026-06-16
hosted25519 marker key in authorized_keys12026-06-16
hostLD_PRELOAD rootkit hook in the agent systemd unit12026-06-16
suricataPOLICY Inbound Docker Engine API container create from internal source12026-06-16
suricataPOLICY Inbound Docker Engine API exec/start from internal source12026-06-16
host/tmp/pwn.sh content signature12026-06-16
yaraVoidLink_FleetAgent12026-06-16
hostVoidLink on-disk footprint12026-06-16