Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
27
17
3
2
2
Contributors
16
10
8
5
3
Categories
26
16
14
13
13
Platforms
26
25
4
3
1
Products / Services
18
12
12
4
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
IDS Protocols
2
This rule detects post-execution activity associated with the lambsys/isp.sh cryptominer campaign. It triggers when a known miner binary (lambsys, procq, or isp.sh) is executed, followed within 3 minutes by suspicious cleanup operations including the deletion of log files (wtmp, btmp, system logs), staging directories, or tampering with command history files and shell environment variables.
Detects the execution of potentially suspicious cleanup and maintenance commands (e.g., clearing history, changing permissions, removing files) on Linux systems that are often associated with post-exploitation activity or evidence removal. The rule monitors for these patterns specifically when initiated by commands involving common suspicious file paths like 'isp.sh', 'lambsys', or '/var/tmp/.xlamb'.
Detects evidence of post-exploitation anti-forensic activity on Cisco SD-WAN components (vManage, vSmart, vBond). This rule monitors for unauthorized removal of logs and exploitation artifacts, the clearing of shell command history, and suspicious modification of file and directory permissions on critical system paths.
This rule detects attempts to unset the HISTFILE environment variable over a TCP connection to port 22 (SSH). Unsetting HISTFILE is a common technique used by attackers to prevent their commands from being recorded in the shell history, thereby evading detection and forensic analysis. The rule specifically looks for the string "unset HISTFILE" case-insensitively within the TCP stream.
This rule detects attempts to clear the Bash history using the 'history -c' command over an established SSH connection. It specifically looks for the case-insensitive string 'history -c' within TCP traffic flowing from the client to the server on port 22 (SSH). This activity is often associated with an attacker attempting to cover their tracks after gaining unauthorized access.
Detects commands that clear interactive shell history or disable history persistence,
consistent with Defense Evasion (impairing command history visibility).
consistent with Defense Evasion (impairing command history visibility).
Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog.
In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
Adversaries may delete this key to cover their tracks after executing commands.
In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
Adversaries may delete this key to cover their tracks after executing commands.
Detects commands that try to clear or tamper with the Linux command history.
This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".
This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog.
In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
Adversaries may delete this key to cover their tracks after executing commands.
In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
Adversaries may delete this key to cover their tracks after executing commands.
Cisco Clear Logs
Sigma
Clear command history in network OS which is used for defense evasion
Detects keywords that could indicate clearing PowerShell history
Detects keywords that could indicate clearing PowerShell history
Detects scripts or commands that disabled the Powershell command history by removing psreadline module
Detects multiple methods used by adversaries to clear or disable Linux
shell command history (bash, zsh) in order to cover tracks and evade investigation.
shell command history (bash, zsh) in order to cover tracks and evade investigation.
Detects methods used by adversaries to clear or disable Linux shell command history (bash or zsh) in order to cover tracks and evade investigation.
Query identity the deletetion of the file ConsoleHost_history.txt, the file stores the process command line history of Powershell
Detects the deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. Adversaries may delete this key to cover their tracks after executing commands, particularly in techniques like those used in clickfix where phishing lures instruct users to execute malicious commands via the Run dialog.
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. Adversaries may delete this key to cover their tracks after executing commands, especially in scenarios like clickfix techniques where users are lured into executing malicious commands via the run dialog.
This analytic detects the usage of PowerShell to delete its command history file, which may indicate an attempt to evade detection by removing evidence of executed commands. PowerShell stores command history in ConsoleHost_history.txt under the user’s profile directory. Adversaries or malicious scripts may delete this file using Remove-Item, del, or similar commands. This detection focuses on file deletion events targeting the history file, correlating them with recent PowerShell activity. While legitimate users may occasionally clear history, frequent or automated deletions should be investigated for potential defense evasion or post-exploitation cleanup activities.
Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Page 2 of 3