Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,144 detections
Filters
Last updated
All Time
Detection languages
3,228
1,086
498
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,979
2,473
1,063
1,026
910
Platforms
39,802
7,144
6,519
3,861
3,601
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,231
1,319
1,319
876
873
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects file and folder permission changes.
Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character
Detect changes in auditd configuration files
Detects calls to hidden files or files located in hidden directories in NIX systems.
Detects the ld.so preload persistence file. See `man ld.so` for more information.
Detects disabling security tools
Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system
Detects the use of Python's base64 decoding functions in command line executions on Linux systems.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.
Detects attempts to read raw disk data using mknod or dd, a technique observed in malicious npm packages to bypass permissions and extract secrets.
This rule detects the creation of directories or files related to the malicious 'plain-crypto-js' package within 'node_modules' folders. This activity is associated with the WAVESHAPER.V2 RAT, which targets developer and CI/CD systems through supply chain compromise of npm packages like Axios.
Detects systemctl commands enabling or starting a service named 'sysupdate', which Canis C2 uses to masquerade as a legitimate system update process and maintain persistence on Linux systems. The service restarts every 30 seconds.
Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
This rule detect using dd and truncate to add a junk data to file.
This rule detect using dd and truncate to add a junk data to file.
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.
Detects removing immutable file attribute.
Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.
Several different variations of this technique have been observed.
Several different variations of this technique have been observed.
Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.
Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.
Detects extracting of zip file from image file
Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.
Detect changes of syslog daemons configuration files
Page 281 of 341