Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
10
6
6
4
2
Contributors
12
9
4
3
1
Categories
20
14
13
5
4
Platforms
24
13
12
4
3
Products / Services
6
4
3
3
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
Detects commandline operations on shell history files
See what commands are being input into the device by other people, full credentials can be in the history
This rule detects command-line operations that target common shell history files on Linux systems. Adversaries often manipulate or delete these files to remove traces of their activities or to extract sensitive information like credentials that might have been typed into the command line. The rule specifically looks for execution events (`EXECVE`) that involve files such as `.bash_history`, `.zsh_history`, `.zhistory`, `.history`, `.sh_history`, and `fish_history`.
Detects attempts to print the contents of common history files (like .bash_history or .zsh_history) using command-line utilities such as `cat`, `head`, `tail`, or `more`. This activity is often performed by adversaries for reconnaissance purposes to gather information about previously executed commands, which may contain sensitive data or reveal system configurations.
This rule detects command-line operations that interact with common shell history files on macOS systems. Adversaries often target these files (e.g., .bash_history, .zsh_history) to extract sensitive information such as credentials or commands executed by users, which can aid in further compromise or understanding the environment.
This rule detects the execution of 'show history', 'show history all', or 'show logging' commands on Cisco devices. These commands can expose sensitive information, including credentials, that have been entered into the device's command-line interface. Adversaries may use these commands to gather credentials or other sensitive configuration details from network devices.
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
Detects commandline operations on shell history files
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Page 2 of 2