Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
32
12
2
1
1
Contributors
20
7
7
4
3
Categories
36
35
28
6
5
Platforms
33
17
2
1
Products / Services
26
11
8
8
7
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects the XHOPELESS wiper routine 'KillNetworkPermanent' which severs network connectivity by resetting the TCP/IP stack using netsh, blocking all traffic via Windows Advanced Firewall commands, and disabling network adapters via devcon.exe as a final destructive action.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
Detects a sequence of commands characteristic of the Stealer/1.0 malware, involving the systematic disabling of security features including Windows Defender, Firewall, UAC, System Restore, Windows Recovery Environment, SafeBoot, and the deletion of Volume Shadow Copies as a precursor to destructive data operations.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
This rule monitors Google Cloud Platform (GCP) Audit Logs for changes to VPC network routes, specifically tracking 'insert' and 'delete' operations. It classifies actors as either human or service account, flags non-Terraform service account modifications, and identifies service accounts originating from unexpected network sources to detect potentially unauthorized infrastructure changes.
This rule detects the deletion of Google Cloud Platform (GCP) network firewall rules. It monitors GCP audit logs for 'v1.compute.firewalls.delete' or 'beta.compute.firewalls.delete' actions. The rule categorizes the actor (human vs. service account) and identifies if the deletion originated from Terraform, providing context on whether the action was likely an automated infrastructure-as-code change or manual intervention.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
UFW Disable Attempt
Sigma
Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
Page 2 of 3