Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
164 detections
Filters
Last updated
All Time
Detection languages
77
32
13
10
9
Contributors
55
38
13
9
8
Categories
104
95
87
64
61
Platforms
155
16
9
5
4
Products / Services
99
49
27
14
11
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
3
1
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
The following analytic detects the use of the crontab command with the list parameter (-l) to enumerate scheduled tasks configured in the invoking user's crontab on Linux systems.
Adversaries may use this information to identify persistence mechanisms, scheduled execution, or potential privilege escalation opportunities.
The use of crontab -l is also common administrative activity and may require tuning based on the executing user, parent process, and environment.
Adversaries may use this information to identify persistence mechanisms, scheduled execution, or potential privilege escalation opportunities.
The use of crontab -l is also common administrative activity and may require tuning based on the executing user, parent process, and environment.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects direct unauthorized modifications to Linux crontab files or the addition of specific known malicious cron job patterns. It specifically monitors for file changes in '/var/spool/cron' and correlates them with 'crontab -e' process executions to identify manual versus automated or malicious modifications. Additionally, it checks for specific hardcoded malicious patterns commonly associated with known threat activity.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects persistence activities initiated by Postgres-related processes or users involving scheduled tasks and system services.
Detects persistence activities initiated by Postgres-related processes or users involving scheduled tasks and system services.
Page 3 of 8