Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,129 detections
Filters
Last updated
All Time
Detection languages
3,215
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,782
7,129
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of Ruby with the '-e' flag, which allows for inline script execution, combined with specific keywords related to socket programming ('rsocket', 'TCPSocket') and common shell names ('ash', 'bash', 'bsh', 'csh', 'ksh', 'pdksh', 'sh', 'tcsh'). This combination is a strong indicator of an attempt to establish a Ruby-based reverse shell.
This rule detects the use of the `wget` command-line utility to download files into potentially suspicious directories, specifically `/tmp/`. Adversaries often use `wget` for ingress tool transfer, downloading malicious payloads or additional tools to a compromised system. The rule looks for `wget` execution combined with the `-O` or `--output-document` flags, which specify an output file, and the presence of `/tmp/` in the command line, indicating a download to a common temporary directory often abused by attackers.
Detects the execution of 'xterm' with command-line arguments indicative of a reverse shell connection, specifically looking for '-display' and a display value ending in ':1'. This pattern is commonly used by attackers to establish a reverse shell.
This rule detects a 'Segmentation Fault' error message in Apache error logs, indicating a crashing Apache worker process. This type of event can be caused by software vulnerabilities, misconfigurations, or malicious activity aiming to disrupt service availability.
This rule detects attempts to change file or folder permissions and ownership on Linux systems by monitoring the execution of the 'chmod' and 'chown' commands. These commands are commonly used by adversaries to modify access controls, potentially to evade defenses, gain access to protected files, or establish persistence.
This rule detects the loading of kernel modules using the 'insmod' command. Loadable Kernel Modules (LKMs) are code segments that can be dynamically loaded into and unloaded from the kernel. Adversaries may leverage LKMs for establishing persistence, elevating privileges, or deploying kernel-mode rootkits, as they operate with the highest system privileges (Ring 0). The detection specifically looks for the execution of 'kmod' with the 'insmod' command.
This rule detects attempts to masquerade as the Linux 'crond' process by copying '/bin/sh' to a file ending with '/crond' and executing it. This technique is often used by adversaries to evade detection by making malicious processes appear as legitimate system services.
This rule detects the use of the 'import' command, part of ImageMagick, to capture screenshots on a Linux system. It specifically looks for executions of 'import' where the arguments indicate a full-screen capture (using '-window root') or a general screenshot saved to a common image file format (PNG, JPG, JPEG). This activity is often associated with adversaries attempting to collect visual information from a compromised system.
Detects the use of the 'xwd' utility to capture screenshots on a Linux system. This rule is particularly relevant for server environments where screenshot utilities are less commonly used by legitimate users, reducing false positives. The detection logic specifically looks for 'xwd' execution with parameters indicating a screen capture, such as '-root' or '-out' followed by a file ending in '.xwd'.
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. Specifically looks for messages related to dropping source port zero packets, denied AXFR requests, and fatal errors causing an exit.
This rule detects the execution of the 'grep' command on Linux systems when it is used to search for specific filenames associated with the GobRAT malware. The filenames include 'apached', 'frpc', 'sshd.sh', and 'zone.arm'. This activity indicates that an attacker, potentially using GobRAT, is attempting to discover files related to their malware deployment or persistence mechanisms.
Detects the use of `iptables` or `ip6tables` commands to flush all firewall rules, tables, and chains, potentially allowing all network traffic. This action is often performed by adversaries to impair defenses and bypass network restrictions.
This rule detects the execution of a script via the SCX RunAsProvider ExecuteScript function, which is associated with the OMIGOD vulnerability. Specifically, it looks for process creation events where the user is 'root', the LogonId is '0', the CurrentDirectory is '/var/opt/microsoft/scx/tmp', and the CommandLine contains '/etc/opt/microsoft/scx/conf/tmpdir/scx'. This pattern indicates the execution of a temporary script created by the SCX agent, often exploited for privilege escalation or initial access.
Detects the use of 'arp -a' or 'ping' commands targeting common private and loopback IP address ranges on Linux systems, which can indicate an adversary performing remote system discovery.
Detects the use of `grep` or `egrep` commands on Linux systems to search for common security software process names. This activity can indicate an adversary attempting to discover installed security solutions on a compromised host.
Detects when a Java process spawns suspicious child processes, specifically various shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), or common command-line tools like curl, wget, and python. This behavior can indicate a Java application being exploited to execute arbitrary commands on the system.
Detects attempts to exploit an Apache Spark server via CVE-2022-33891, which is a shell command injection vulnerability, by looking for specific patterns in web server query strings.
This rule detects potential exploitation attempts targeting the Centos Web Panel (CWP) 7, specifically looking for indicators related to CVE-2022-44877, an unauthenticated remote code execution vulnerability. The detection logic focuses on POST requests to '/login/index.php' containing specific query parameters and keywords often associated with reverse shells or command injection, such as 'login=$(' or base64 encoded 'python' strings.
This rule detects common SQL exception types in Python applications as defined by PEP 249. These exceptions (DataError, IntegrityError, ProgrammingError, OperationalError) indicate issues during database operations, which could range from malformed queries to database connectivity problems or constraint violations. While often benign, repeated or unusual occurrences of these errors could signal application vulnerabilities being exploited (e.g., SQL injection attempts leading to syntax errors) or other malicious database interactions.
This rule detects attempts to remove the immutable file attribute on Linux systems using the 'chattr' command with the '-i' flag. The immutable attribute prevents a file from being modified, deleted, or renamed, even by the root user. Adversaries may remove this attribute to modify critical system files or logs for defense evasion purposes.
This rule detects attempts to gather system and hardware information on Linux systems by monitoring access to specific files and directories that contain details about the BIOS version, product name, chassis vendor, SCSI devices, IDE hard drive models, kernel version, and operating system release information. Adversaries often access these files during the discovery phase to understand the environment they have compromised.
Page 334 of 340