Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,129 detections
Filters
Last updated
All Time
Detection languages
3,215
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,782
7,129
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of the 'execve_hijack' component of the Triple Cross eBPF rootkit. This specific file is used by the rootkit to elevate privileges by hijacking the 'execve' system call, often in conjunction with the 'sudo' command.
This rule detects the execution of specific commands associated with the installation of the Triple Cross eBPF rootkit. It looks for commands executed via 'sudo' that contain specific 'tc' (traffic control) parameters, including 'qdisc' and 'filter', along with a network interface like 'enp0s3'. These command line arguments are characteristic of the 'deployer.sh' script used by the Triple Cross rootkit to establish persistence and hide its presence using eBPF.
Detects the usage of the 'usermod' command to add a user to either the 'root' or 'sudoers' group on a Linux system. This activity can indicate privilege escalation or persistence mechanisms by an attacker.
This rule detects various suspicious exceptions within Django web applications. These exceptions, such as 'SuspiciousOperation' and its subclasses (e.g., 'DisallowedHost', 'InvalidSessionKey', 'RequestDataTooBig'), as well as 'PermissionDenied', often indicate attempts to exploit vulnerabilities, bypass security controls, or engage in other malicious activities against the web application. Monitoring these exceptions can help identify potential attacks like web parameter tampering, session hijacking attempts, or unauthorized access attempts.
This rule detects the execution of the 'cat' command used to append a zip file to an image file. This technique is commonly used in steganography to hide data within seemingly innocuous files. The rule specifically looks for 'cat' being executed with two arguments: one ending in a common image file extension ('.jpg' or '.png') and another ending in '.zip'. This pattern suggests an attempt to concatenate the contents of a zip file onto an image file.
Detects changes to critical syslog daemon configuration files on Linux hosts. Adversaries may modify these files to disable or reconfigure logging, thereby impairing defenses and hindering the detection of their activities.
Detects the use of the 'steghide' utility to extract hidden files from image files (JPG or PNG). Adversaries may use steganography to conceal data and evade detection.
Detects attempts to exploit the Shellshock vulnerability (CVE-2014-6271) by looking for specific shellshock expressions in log files. These expressions are commonly used to inject and execute arbitrary commands.
Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. These errors often suggest malformed requests or attempts to trigger vulnerabilities in the VSFTPD service.
Detects the creation of a new named pipe using the 'mkfifo' utility on Linux systems. Named pipes can be used for inter-process communication and can sometimes be leveraged by adversaries for various purposes, including data exfiltration, command and control, or as a component of more complex malware.
Detects the execution of netcat or ncat with the '-e' or '-c' flag, combined with common shell commands. This pattern is indicative of an attempt to establish a reverse shell, where a shell is spawned and connected back to an attacker-controlled listener.
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. This activity is indicative of the OMIGOD vulnerability exploitation.
This rule detects attempts to disable security tools on Linux systems. Specifically, it looks for command-line invocations of `iptables`, `ip6tables`, `firewalld`, `cbdaemon` (Carbon Black), `falcon-sensor` (CrowdStrike), and `setenforce` (SELinux) with arguments indicating a stop or disable action. This activity is often associated with adversaries attempting to impair defenses to facilitate further malicious actions.
Detects potential Spring Expression Language (SpEL) Injection exploitation attempts, which can lead to Remote Code Execution (RCE). The rule specifically looks for the 'org.springframework.expression.ExpressionException' keyword in application error logs, indicating that an attempt to evaluate a malicious expression might have occurred or failed.
Detects attempts to collect image data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for 'xclip' execution with parameters indicating selection from the clipboard for image data output. It is highly recommended for server environments due to frequent legitimate clipboard utility usage on user workstations.
Detects attempts to overwrite or wipe files using the 'dd' command with '/dev/null' or '/dev/zero' as input. This technique is commonly used for data destruction, making files irrecoverable.
This rule detects an anomaly in Apache Guacamole sessions where two users are simultaneously present in the same session. This could indicate unauthorized access, session hijacking, or a shared credential scenario that deviates from normal behavior.
Detects exploitation attempts related to the Nimbuspwn privilege escalation vulnerabilities (CVE-2022-29799 and CVE-2022-29800) on Linux systems. The rule looks for specific keywords that indicate the `networkd-dispatcher` service is being manipulated, potentially to execute arbitrary code with elevated privileges.
This rule detects a suspicious command sequence often associated with the JexBoss exploitation tool. Specifically, it looks for the execution of 'bash -c /bin/bash' followed by a network connection attempt using '&/dev/tcp/'. This combination indicates an attempt to establish a reverse shell or exfiltrate data over TCP.
Detects the creation of the file "/tmp/rootlog" which is used by the TripleCross eBPF rootkit as a way to check if the backdoor is already running. This file acts as a lockfile to prevent multiple instances of the rootkit from running simultaneously.
Detects potential overwriting and deletion of a file using the 'dd' command. This rule specifically looks for executions of 'dd' where the output file ('of=') is specified and the input is either '/dev/zero' (writing zeros) or '/dev/null' (effectively truncating/deleting content). This pattern is commonly used for data destruction.
Page 333 of 340