Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
153 detections
Filters
Last updated
All Time
Detection languages
92
19
14
13
6
Contributors
74
30
9
9
8
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
95
47
19
11
5
Products / Services
65
31
31
19
13
MITRE Techniques
54
52
24
19
17
CVEs
16
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.
Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.
Detects unauthorized modifications to the 'wp_users' table in a WordPress database. The rule correlates specific WordPress REST API calls (oEmbed or batch processing endpoints) originating from the same source IP address that performs database inserts or updates, while explicitly excluding activity originating from verified Admin UI sessions.
This rule detects potentially unauthorized database manipulation of the 'xadmin' platform, including suspicious administrative role modifications and deletions. It also monitors for suspicious Python script execution involving the 'bcrypt' library, which can be used to generate or verify password hashes in potentially malicious scripts.
This rule detects the use of database-related processes (mysql) or scripts (python) interacting with MySQL User-Defined Function (UDF) mechanisms. Attackers often abuse UDFs to execute arbitrary commands, load external libraries, or facilitate lateral movement/privilege escalation within a database environment.
Detects potentially unauthorized data exfiltration or bulk extraction activities within Google Cloud BigQuery. The rule monitors for large-scale data queries (SELECT * or queries without filters), data exports to external Google Cloud Storage buckets, and queries executed by automated scripts or tools, which are common indicators of staged data theft following cloud environment compromise.
This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.
Detects processes that execute commands involving SQL database operations, specifically those related to AES encryption functions or table management (create/drop operations) on configurations. This activity is often associated with potential database manipulation or data destruction attempts by an attacker.
This rule monitors for the execution of the 'pg_dump' utility by Python-based applications (like Langflow), followed by the deletion of a file on the same host within 60 minutes. This behavior may indicate an adversary staging data, dumping a database, and then attempting to remove evidence of the activity.
Detects command-line execution of database drop operations combined with the disabling of foreign key constraints, which is indicative of malicious database manipulation or automated data destruction attempts.
Detects potentially malicious activity involving MySQL processes, specifically focusing on the creation of files within the /var/lib/mysql-files/ directory, use of SQL 'INTO OUTFILE' for file output, or the use of 'LOAD_FILE()' to read sensitive system files like /etc/hostname or /proc/1/mountinfo, often indicative of SQL injection exploitation or unauthorized data access.
Detects instances where the 'pg_dump' database utility is executed, followed by the deletion of a file within a one-hour window by the same agent. This behavior is indicative of an attacker extracting sensitive database contents and subsequently attempting to remove evidence of the dump or staging files.
Detects high-frequency execution of MySQL enumeration queries (such as showing databases, tables, or selecting from the information_schema) by the MySQL client process. This behavior is often associated with database reconnaissance or automated scanning during the discovery phase of an attack.
Detects the use of the PostgreSQL client utility (psql.exe) to query the 'VeeamBackup' database, a technique observed in Akira ransomware intrusions to extract sensitive credentials directly from the backup server's configuration.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects the execution of psql.exe with arguments pointing to a VeeamBackup database, or suspicious database queries containing 'credentials' or 'SELECT' statements. The rule specifically alerts when this behavior is initiated by PowerShell or WMI processes, which are common indicators of automated post-exploitation activities intended to extract sensitive information from the backup infrastructure.
Detects execution of psql.exe with command line arguments containing 'VeeamBackup' and 'credentials', which may indicate an attempt to access or extract credentials from a PostgreSQL database associated with Veeam Backup software.
Detects creation and deletion of an Azure SQL firewall rule by the same caller within a short window, which can provide temporary database access while reducing later evidence. This behavior is often indicative of an adversary attempting to gain temporary access to a database, perform actions, and then remove their tracks by deleting the firewall rule.
Detects unauthorized execution of Oracle DBMS_SCHEDULER jobs combined with UTL_FILE output retrieval, a TTP observed in Operation Escaneo. The rule identifies suspicious command lines involving common database-layer exploitation scripts, manipulation of DBMS_SCHEDULER jobs, and interaction with the /tmp directory to exfiltrate or read command outputs.
Detects anomalous process execution patterns where a database process (postgres or postmaster) or a common system utility (nc, python, bash) is observed initiating unauthorized network connections to a known external C2 IP or accessing sensitive cryptographic files (e.g., server.key). This behavior is indicative of potential post-exploitation activity, specifically the exfiltration of credentials or sensitive data via database-level command execution (sys_eval) or direct file manipulation.
Page 6 of 8