Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
KQL Query from file: Discord Invite Hijacking Detection
KQL Query
KQL Query from file: Detect CVE-2025-27607 (CVSS 8.8)
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: glibc critical vulnerability (CVSS 9.8)
KQL Query from file: Finding internet facing device with CUPS
KQL Query from file: Critical Vulnerability in Elastic Kibana
Detects the use of GCC (or C89/C99) with the '-wrapper' option to execute a shell, which can be leveraged for privilege escalation, unauthorized command execution, or to break out from restricted environments. This technique is often documented in resources like GTFOBins.
Detects the use of the 'find' command in Linux to execute a shell. This behavior is often associated with privilege escalation, unauthorized command execution, or exploitation attempts, particularly when leveraging misconfigurations or vulnerabilities to break out of restricted environments.
This rule detects the execution of the 'capsh' utility followed by a double dash ('--'), which is a common pattern used to invoke a shell through 'capsh'. This technique can be used by adversaries to bypass restricted shell environments or escalate privileges by leveraging 'capsh' capabilities.
This YARA rule detects the ChaosRAT backdoor by identifying specific byte sequences related to its network communication, system information gathering, and file download capabilities. The rule includes three distinct versions of these functionalities, indicating evolution or different variants of the malware. Detection relies on the presence of these unique byte patterns within executable files, specifically ELF files as indicated by the magic byte check.
Detects the use of the 'env' command to invoke a shell on Linux systems. This activity can indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands by manipulating environment variables before launching a shell.
Detects the use of the "ssh" utility to execute a shell, which can indicate privilege escalation, unauthorized command execution, or breakout from restricted environments. The rule specifically looks for `ssh` commands that include `ProxyCommand=;`, `permitlocalcommand=yes`, or `localhost` in conjunction with common shell invocations like `/bin/bash`, `/bin/sh`, etc.
Detects the execution of 'awk' or its sibling commands (gawk, mawk, nawk) to invoke a shell using the `system()` function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. The rule specifically looks for 'git' as the parent process, combined with command-line arguments '-p' and 'help', and a child process command line containing 'bash 0<&1', 'dash 0<&1', or 'sh 0<&1'. This pattern is indicative of exploiting git's interactive help functionality to spawn a shell.
This rule detects the use of the 'flock' command in conjunction with common shell binaries to execute a shell. This behavior can be indicative of privilege escalation attempts, unauthorized command execution, or efforts to break out of restricted environments. The rule specifically looks for the 'flock' command being executed with the '-u' option and a command line containing paths to common shells like bash, dash, fish, sh, or zsh.
This rule detects the execution of shell programs (bash, dash, fish, sh, zsh) using the 'nice' utility on Linux systems. This behavior can be indicative of an adversary attempting to escalate privileges, execute unauthorized commands, or break out of restricted environments by manipulating process priority.
This rule detects the execution of inline Python code that uses the `os.system()` function to spawn a shell. Specifically, it looks for Python interpreter executables being run with the `-c` argument (for inline code execution) and the command line containing both `os.system(` and common shell paths like `/bin/bash`, `/bin/sh`, etc. This technique is often used by adversaries to gain interactive shell access or execute arbitrary commands on a compromised system.
Page 320 of 347