Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects suspicious log entries in Linux log files
Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings
GCTI Remote Access Tools
YARA-L
Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool list
GCTI Tor Exit Nodes
YARA-L
Alert traffic destined for known Tor exit nodes
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
Detects potentially suspicious child processes spawned by the SSH daemon (sshd) that execute commands using 'bash -c' or 'sh -c' as the root user. This behavior is indicative of potential exploitation of CVE-2024-3094, a backdoor in the XZ Utils library.
Remote File Copy
Sigma
Detects the use of tools that copy files from or to remote systems
This rule detects suspicious usage of the 'curl' command on Linux systems that indicates a file upload or data transfer to a web service. It specifically looks for the 'curl' executable being run with command-line arguments such as '--form', '--upload-file', '--data', or their variations ('--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), or the shorthand options '-F', '-T', '-d'. The rule filters out connections to localhost or 127.0.0.1 to reduce false positives from legitimate local development or testing activities.
This rule detects the execution of common archiving utilities (zip, gzip, tar) on Linux systems. Adversaries often compress data prior to exfiltration to reduce its size and make it easier to transfer. This rule specifically looks for the 'execve' system call with 'zip', 'gzip -k', or 'tar -c' as the primary command and arguments.
Detects the execution of the 'mount' command with the 'hidepid=2' option. This parameter is used to hide processes from other users on the system, which can be leveraged by adversaries for defense evasion by making their malicious processes less visible.
This rule detects network connections initiated by an executable to sub-domains associated with the "LocaltoNet" tunneling service. LocaltoNet is a reverse proxy that exposes localhost services to the internet. Adversaries have been observed leveraging this service for command-and-control (C2) activities, often to bypass multi-factor authentication (MFA) and perimeter security controls.
Alert on Benign Binary contacting a TOR IP
A malicious file contacting a known Tor Exit Node.
IP Target Prevalence
YARA-L
Detect events that are communicating to IP addresses that have a low rolling max prevalence.
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
Detects a suspicious curl process start the adds a file to a web request
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
Detects user account creation on ESXi system via esxcli
Page 325 of 347