Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Remote File Copy
Sigma
Detects the use of tools that copy files from or to remote systems
This rule detects suspicious usage of the 'curl' command on Linux systems that indicates a file upload or data transfer to a web service. It specifically looks for the 'curl' executable being run with command-line arguments such as '--form', '--upload-file', '--data', or their variations ('--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), or the shorthand options '-F', '-T', '-d'. The rule filters out connections to localhost or 127.0.0.1 to reduce false positives from legitimate local development or testing activities.
This rule detects the execution of common archiving utilities (zip, gzip, tar) on Linux systems. Adversaries often compress data prior to exfiltration to reduce its size and make it easier to transfer. This rule specifically looks for the 'execve' system call with 'zip', 'gzip -k', or 'tar -c' as the primary command and arguments.
Detects the execution of the 'mount' command with the 'hidepid=2' option. This parameter is used to hide processes from other users on the system, which can be leveraged by adversaries for defense evasion by making their malicious processes less visible.
This rule detects network connections initiated by an executable to sub-domains associated with the "LocaltoNet" tunneling service. LocaltoNet is a reverse proxy that exposes localhost services to the internet. Adversaries have been observed leveraging this service for command-and-control (C2) activities, often to bypass multi-factor authentication (MFA) and perimeter security controls.
Alert on Benign Binary contacting a TOR IP
A malicious file contacting a known Tor Exit Node.
IP Target Prevalence
YARA-L
Detect events that are communicating to IP addresses that have a low rolling max prevalence.
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
Detects user account creation on ESXi system via esxcli
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
Detects a suspicious curl process start the adds a file to a web request
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
This analytic detects the insertion of a Linux kernel module using the `insmod` utility. It leverages data from Linux Auditd, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this could lead to unauthorized code execution, persistent access, and severe compromise of the affected system.
The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise.
The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, similar to 'sudo'. The detection leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant as 'doas' can be exploited by adversaries to gain elevated privileges on a compromised host. If confirmed malicious, this could lead to unauthorized administrative access, potentially compromising the entire system.
The following analytic detects suspicious use of the `rmmod` utility for kernel module removal, which may indicate an attacker attempt to unload critical or security-related kernel modules. The `rmmod` command is used to remove modules from the Linux kernel, and unauthorized use can be a tactic to disable security features, conceal malicious activities, or disrupt system operations. By monitoring for unusual or unauthorized `rmmod` activity, this analytic helps identify potential tampering with kernel modules, enabling security teams to take proactive measures to protect system integrity and security.
Page 319 of 340