Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,129 detections
Filters
Last updated
All Time
Detection languages
3,215
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,782
7,129
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the use of the '--cpu-priority' command-line parameter, which is commonly associated with cryptocurrency miners, particularly XMRig, to prioritize CPU usage for mining operations. This can indicate the presence of coin mining malware on a system.
Detects the stopping of system firewall services (firewalld, iptables, ufw) on Linux systems. Adversaries may disable firewalls to bypass network controls, facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects various commands and file accesses indicative of system information discovery on Linux systems using auditd logs. It looks for access to common system release files like /etc/lsb-release, /etc/redhat-release, and /etc/issue. Additionally, it identifies the execution of commands such as 'uname', 'uptime', 'lsmod', 'hostname', and 'env'. The rule also flags 'grep' commands searching for virtualization indicators ('vbox', 'vm', 'xen', 'virtio', 'hv') and 'kmod list' commands, which are often used to enumerate loaded kernel modules.
This rule detects the execution of the `bpftrace` utility with the `--unsafe` option. The `bpftrace` tool is a high-level tracing language for Linux, and the `--unsafe` option allows it to perform operations that could potentially compromise system stability or security, such as writing to arbitrary memory locations or executing arbitrary code in the kernel. This usage could indicate an attempt to perform advanced system manipulation, potentially for privilege escalation, stealthy execution, or system compromise.
This rule detects command-line parameters and strings commonly associated with cryptocurrency mining software, specifically targeting Monero miners like XMRig. It looks for specific arguments such as CPU priority settings, donation levels, pool addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), algorithm specifications ('--algo=rx/0'), and base64 encoded versions of these strings. It also includes a specific command for loading the 'msr' kernel module, which can be used by miners to optimize performance.
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.
Detects potential exploitation attempts of CVE-2023-2283, an authentication bypass vulnerability in libSSH. The exploitation method causes an error message indicating that keys for curve25519 could not be generated. This error message serves as a sign of an exploitation attempt, not necessarily a successful exploitation.
This rule detects the execution of specific binaries identified as being used by the UNC4841 threat group to deploy the SEASPY backdoor. The binaries include 'BarracudaMailService', 'resize2fstab', and 'resize_reisertab'. Detection is based on the image path ending with any of these specific names.
This rule detects the execution of the 'unzip' command where the target file has a common image file extension ('.jpg' or '.png'). This behavior is indicative of an attempt to extract hidden information, specifically a zip archive, from an image file, a technique often used in steganography for defense evasion or data exfiltration.
Detects the spawning of suspicious child processes by an Atlassian Confluence server, specifically looking for shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), curl, wget, or python being executed as child processes of the Confluence Java process. This behavior is indicative of successful exploitation of CVE-2022-26134, a critical remote code execution vulnerability in Atlassian Confluence. The rule focuses on the post-exploitation phase where an attacker would execute commands on the compromised server.
Detects the execution of PHP CLI with the "-r" flag to run inline PHP code, specifically looking for calls to the "fsockopen" function. This combination is often used by attackers to create sockets for reverse shell connections, potentially in conjunction with functions like "exec" or "fopen". The rule also checks for common Unix shell names in the command line, indicating an attempt to spawn a shell.
Detects the creation or modification of scheduled cron jobs where the command line argument contains '/tmp/'. This behavior is often indicative of an adversary attempting to establish persistence or execute malicious code from a temporary directory using the cron utility.
Detects the execution of the 'curl' command on Linux systems when it includes options to set a custom user agent. This behavior can be indicative of command and control communication or data exfiltration attempts where an adversary tries to mimic legitimate web traffic or evade detection by changing the default user agent string.
Detects the execution of common Linux utilities used to discover system network connections and logged-in users. Specifically, it looks for 'who', 'w', 'last', 'lsof', and 'netstat' commands. It filters out legitimate calls from '/usr/bin/landscape-sysinfo' when 'who' is used.
This rule detects the presence of base64 encoded shebangs (e.g., #!/bin/bash) within command-line arguments. Adversaries often encode commands to evade detection and obfuscate their malicious intent. The rule specifically looks for the base64 representations of common shell shebangs, indicating that a script or command containing these might be decoded and executed.
Detects the execution of the 'crontab -l' command, which is used to list scheduled cron jobs for the current user. This activity can be part of discovery tactics by adversaries to understand the system's scheduled tasks.
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity.
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity. This rule looks for specific patterns in the command line arguments that indicate an attempt to establish a reverse shell using Perl's networking capabilities.
This rule detects the use of the 'find' command on Linux systems with specific permission-related arguments. These arguments are often used by attackers during the discovery phase to locate files with unusual permissions, such as SUID/SGID binaries (-perm -4000, -perm -2000, -perm -u=s, -perm -g=s) which can be exploited for privilege escalation, or world-writable files (-perm 0777, -perm -222, -perm -o w) which could be used for persistence or data modification. It also looks for world-executable files (-perm -o x).
Detects suspicious child processes spawned from an interactive bash shell. This rule looks for specific command-line patterns (e.g., base64 encoding, pty.spawn for pseudo-terminal allocation) or specific executables (e.g., whoami, iptables, ncat/netcat) that are uncommon to be direct children of an interactive bash session, indicating potential malicious activity like reverse shells or reconnaissance.
Detects the execution of common shell interpreters (bash, csh, dash, fish, ksh, sh, zsh) where the parent process is located within the '/tmp/' directory. This behavior is often indicative of malware, such as GobRAT, dropping and executing malicious components in temporary locations to evade detection.
Page 332 of 340