Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
129 detections
Filters
Last updated
All Time
Detection languages
58
38
10
6
5
Contributors
36
30
15
10
6
Categories
84
80
61
37
17
Platforms
119
10
5
2
2
Products / Services
66
31
28
23
21
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
3
2
2
2
IDS Classtypes
2
1
IDS Protocols
3
The analytic detects the creation of the `doas.conf` file on a Linux host. This file is used by the `doas` utility to allow standard users to perform tasks as root, similar to `sudo`. The detection leverages filesystem data, focusing on the creation of the `doas.conf` file. This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root privileges, leading to full system compromise.
The following analytic detects the execution of Emacs with elevated privileges using the `sudo` command and the `--eval` option. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line arguments. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain root access by running Emacs with elevated permissions. If confirmed malicious, this could allow an attacker to execute arbitrary commands as root, leading to full system compromise and unauthorized access to sensitive information.
The analytic detects the use of the 'make' command with elevated privileges to execute system commands as root, potentially leading to a root shell. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include 'make', '--eval', and 'sudo'. This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access. If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
Page 7 of 7