Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
172 detections
Filters
Last updated
All Time
Detection languages
76
31
20
11
10
Contributors
46
34
16
10
8
Categories
69
66
56
51
23
Platforms
115
45
31
14
8
Products / Services
66
31
30
16
14
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
3
2
1
1
IDS Classtypes
6
2
1
1
IDS Protocols
10
Detects scenarios where the OpenSSH server starts listening on an SSH socket, which could indicate an attacker enabling the service for remote access or persistence. This rule specifically looks for EventID 4 from the OpenSSH service with the process name 'sshd' and a payload starting with 'Server listening on '.
This rule detects the potential use of an SSH utility to establish Remote Desktop Protocol (RDP) over a reverse SSH Tunnel. Attackers commonly use this technique to enable routing of network packets that would otherwise not reach their intended destination, bypassing network segmentation or firewalls. The detection logic looks for command-line arguments containing the RDP port ':3389' in conjunction with common SSH tunneling switches such as '-L', '-P', '-R', '-pw', or '-ssh'.
Detects the use of Plink (PuTTY Link) for suspicious remote port forwarding to a local port. This technique can be used by adversaries to bypass network restrictions and establish tunnels for command and control or data exfiltration.
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Page 9 of 9