Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Yara rule that detects GTPDOOR backdoor.
This YARA rule detects the NoodRAT backdoor by identifying specific byte sequences (patterns) associated with its core functionalities. These functionalities include changing the system name, decrypting configuration data, encrypting and sending data, and receiving and decrypting data. The rule specifically targets Linux ELF executables, indicated by the magic byte `0x464C457F` at offset 0.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects suspicious modifications to sensitive or critical system files on Linux systems. This rule monitors for common command-line utilities (like 'cat', 'echo', 'grep', 'vi', 'nano', 'sed') being used with output redirection ('>') or directly to edit files within critical system directories and configuration files. This activity could indicate an attacker attempting to alter system behavior, maintain persistence, or escalate privileges by modifying files that are not expected to change without explicit administrative planning.
Yara rule that detects NoodRAT backdoor.
Detects suspicious error messages from the OpenSSH daemon that may indicate an attempted exploit or a fatal error during an SSH connection attempt. These errors could be triggered by malformed requests or unusual client behavior designed to uncover vulnerabilities or bypass authentication.
Detects attempts to change file time attributes on Linux systems using the 'touch' command with specific flags, which can be used by adversaries to hide new or modified files by making their timestamps appear legitimate. This technique is often referred to as timestomping.
This rule detects the execution of common network sniffing tools, specifically 'tcpdump' or 'tshark', when they are invoked with arguments indicating an attempt to capture network traffic from a specific interface. The rule looks for the '-c' argument (for count) and the '-i' argument (for interface) in the command line, which are typical indicators of active network sniffing.
This rule detects the execution of `iptables` commands that configure TCP port redirection, specifically looking for the `--to-ports 42` or `--to-ports 43` arguments. This behavior is associated with the BPFDoor malware, which uses iptables to redirect incoming traffic on a specific port (e.g., SSH port 22) to a different, often higher, port where its shell is listening, effectively bypassing firewall rules for the attacker's host.
Clear Linux Logs
Sigma
Detects attempts to clear logs on the system by identifying command-line executions of 'rm', 'shred', or 'unlink' targeting common log directories like '/var/log' and '/var/spool/mail'. Adversaries may clear system logs to hide evidence of an intrusion.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
This rule detects suspicious command-line patterns indicative of reverse shell attempts. It looks for various common techniques used to establish a reverse shell, including bash, sh, netcat, socat, Perl, Python, Ruby, and PHP one-liners that connect back to an attacker-controlled host. The rule also includes patterns for xterm reverse shells and specific shell commands often used in conjunction with reverse shells.
This rule detects specific commands commonly used to remove or empty the syslog file on Linux systems. Adversaries may clear or modify system logs to remove evidence of their activities, hindering incident response and forensic analysis. The rule specifically looks for 'rm' commands with various flags (e.g., -r, -f, -rf) and 'mv' commands targeting '/var/log/syslog', as well as redirection to empty the file ('>/var/log/syslog').
Detects the installation of suspicious packages using common Linux package managers (apt, yum, rpm, dpkg). The rule specifically looks for keywords associated with network scanning, sniffing, and proxy tools, which could indicate reconnaissance, network analysis, or attempts to bypass network controls by an adversary.
This rule detects access to specific '.lock' and '.pid' files in the '/var/run/' directory, which are known indicators of the BPFDoor backdoor. The rule specifically looks for access to 'haldrund.pid', 'xinetd.lock', and 'kdevrund.pid'.
This rule detects attempts to delete history files, such as bash_history or zsh_history, on Linux systems. Adversaries often delete these files to remove traces of their activities and hinder forensic analysis. The rule specifically looks for process creation events where commands like 'rm', 'unlink', or 'shred' are used with command-line arguments indicating history files.
Detects attempts to exploit the Grafana path traversal vulnerability (CVE-2021-43798) by looking for specific path traversal sequences combined with requests to known Grafana plugin directories that result in a successful HTTP status code (200).
This rule detects command-line operations that target common shell history files on Linux systems. Adversaries often manipulate or delete these files to remove traces of their activities or to extract sensitive information like credentials that might have been typed into the command line. The rule specifically looks for execution events (`EXECVE`) that involve files such as `.bash_history`, `.zsh_history`, `.zhistory`, `.history`, `.sh_history`, and `fish_history`.
This rule detects attempts to enable BPF kprobes tracing on a Linux system. This is achieved by writing '1' to specific files within the '/sys/kernel/debug/tracing/events/kprobes/' directory, specifically targeting '/myprobe/enable' or '/myretprobe/enable'. This activity can be indicative of an attacker attempting to gain deep system visibility or to implement advanced evasion techniques.
This rule detects the use of 'dd' and 'truncate' commands to add junk data to a file, a technique adversaries may employ for binary padding to evade detection. Specifically, it looks for 'truncate' with the '-s' (size) option or 'dd' with 'if=' (input file) but without 'of=' (output file), indicating potential in-place modification or padding.
Detects the execution of the 'groupdel' command, which is used to delete a group on Linux systems. This activity can be abused by threat actors to remove evidence of their presence or to disrupt legitimate user access by deleting groups.
Page 329 of 340