Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
180 detections
Filters
Last updated
All Time
Detection languages
56
32
32
15
13
Contributors
65
26
15
14
14
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
85
76
14
9
8
Products / Services
50
38
37
24
20
MITRE Techniques
110
72
50
33
30
CVEs
4
2
1
1
1
IDS Classtypes
7
2
1
IDS Protocols
9
1
Detect when Google Cloud Storage buckets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detects PowerShell scripts that modify the Access Control List (ACL) of a file or folder using the `Set-Acl` cmdlet. This activity can be indicative of an adversary attempting to change permissions to gain unauthorized access, elevate privileges, or maintain persistence.
Detects suspicious command executions on Linux systems, specifically focusing on modifications to file permissions (chmod 777, chmod u+s) and copying of shell binaries (/bin/ksh, /bin/sh). These actions are often associated with malware or hacking activities, such as privilege escalation or establishing persistence.
This rule detects the use of the 'find' command on Linux systems with specific permission-related arguments. These arguments are often used by attackers during the discovery phase to locate files with unusual permissions, such as SUID/SGID binaries (-perm -4000, -perm -2000, -perm -u=s, -perm -g=s) which can be exploited for privilege escalation, or world-writable files (-perm 0777, -perm -222, -perm -o w) which could be used for persistence or data modification. It also looks for world-executable files (-perm -o x).
Detects the use of the 'chmod' command to modify file permissions in suspicious directory paths commonly used by malware for persistence or evasion. This rule specifically looks for chmod operations within '/tmp/', '/.Library/', '/etc/', and '/opt/' directories.
This rule detects attempts to change file or folder permissions and ownership on Linux systems by monitoring the execution of the 'chmod' and 'chown' commands. These commands are commonly used by adversaries to modify access controls, potentially to evade defenses, gain access to protected files, or establish persistence.
Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity can be indicative of an adversary trying to elevate privileges, establish persistence, or evade defenses by modifying critical system file permissions.
This rule detects attempts to remove the immutable file attribute on Linux systems using the 'chattr' command with the '-i' flag. The immutable attribute prevents a file from being modified, deleted, or renamed, even by the root user. Adversaries may remove this attribute to modify critical system files or logs for defense evasion purposes.
This rule detects the usage of the 'chattr' utility with the '-i' flag to remove the immutable file attribute on Linux systems. Removing this attribute can allow adversaries to modify or delete critical system files that were previously protected, often as a defense evasion technique to hinder forensic analysis or remove persistence mechanisms.
Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity is suspicious as it can be used by adversaries to gain persistence, elevate privileges, or evade defenses by modifying critical system file permissions.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
Detects PowerShell execution using the `Set-Acl` cmdlet to modify the Access Control List (ACL) of a file or folder. This can be used by adversaries to change permissions, potentially granting themselves or other users/groups unauthorized access or denying access to legitimate users/services as a form of defense evasion or impact.
Page 9 of 9