Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of common network scanning and reconnaissance tools on Linux systems. These tools are often used by adversaries to enumerate local or remote network services, identify open ports, and gather information about network topology and available hosts. The rule specifically looks for the execution of tools like netcat (when not in listen mode), nmap, hping, naabu, autorecon, and telnet.
Detects known hacktool execution based on image name.
This YARA rule detects the GTPDOOR backdoor by identifying specific byte patterns within its code. The rule includes two main detection blocks, one for 'v1' and another for 'v2' versions of the backdoor, each looking for distinct functions related to sending results to a peer, executing remote commands, sending replies, and checking if the daemon is already running. The 'v1' block specifically targets functions like 'send_result_to_peer_v1_p*', 'execute_remote_command_v1', 'send_reply_v1_p*', and 'daemon_already_running_check_v1'. The 'v2' block targets 'send_result_to_peer_v2_p*', 'execute_remote_command_v2', and 'main_routine_v2_p*'. The rule also ensures the file is an ELF executable by checking the magic bytes at the beginning of the file.
Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.
Detects the use of "vim" and its sibling commands (rvim, vimdiff) to execute a shell or proxy commands. This behavior can be indicative of privilege escalation, unauthorized command execution, or attempts to break out of restricted environments by leveraging the capabilities of these text editors to run arbitrary commands or scripts (e.g., via :!/, :lua, :py, or direct shell calls).
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Yara rule that detects GTPDOOR backdoor.
This YARA rule detects the NoodRAT backdoor by identifying specific byte sequences (patterns) associated with its core functionalities. These functionalities include changing the system name, decrypting configuration data, encrypting and sending data, and receiving and decrypting data. The rule specifically targets Linux ELF executables, indicated by the magic byte `0x464C457F` at offset 0.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects suspicious modifications to sensitive or critical system files on Linux systems. This rule monitors for common command-line utilities (like 'cat', 'echo', 'grep', 'vi', 'nano', 'sed') being used with output redirection ('>') or directly to edit files within critical system directories and configuration files. This activity could indicate an attacker attempting to alter system behavior, maintain persistence, or escalate privileges by modifying files that are not expected to change without explicit administrative planning.
Yara rule that detects NoodRAT backdoor.
Detects suspicious error messages from the OpenSSH daemon that may indicate an attempted exploit or a fatal error during an SSH connection attempt. These errors could be triggered by malformed requests or unusual client behavior designed to uncover vulnerabilities or bypass authentication.
Detects attempts to change file time attributes on Linux systems using the 'touch' command with specific flags, which can be used by adversaries to hide new or modified files by making their timestamps appear legitimate. This technique is often referred to as timestomping.
This rule detects the execution of common network sniffing tools, specifically 'tcpdump' or 'tshark', when they are invoked with arguments indicating an attempt to capture network traffic from a specific interface. The rule looks for the '-c' argument (for count) and the '-i' argument (for interface) in the command line, which are typical indicators of active network sniffing.
This rule detects the execution of `iptables` commands that configure TCP port redirection, specifically looking for the `--to-ports 42` or `--to-ports 43` arguments. This behavior is associated with the BPFDoor malware, which uses iptables to redirect incoming traffic on a specific port (e.g., SSH port 22) to a different, often higher, port where its shell is listening, effectively bypassing firewall rules for the attacker's host.
Clear Linux Logs
Sigma
Detects attempts to clear logs on the system by identifying command-line executions of 'rm', 'shred', or 'unlink' targeting common log directories like '/var/log' and '/var/spool/mail'. Adversaries may clear system logs to hide evidence of an intrusion.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
This rule detects suspicious command-line patterns indicative of reverse shell attempts. It looks for various common techniques used to establish a reverse shell, including bash, sh, netcat, socat, Perl, Python, Ruby, and PHP one-liners that connect back to an attacker-controlled host. The rule also includes patterns for xterm reverse shells and specific shell commands often used in conjunction with reverse shells.
This rule detects specific commands commonly used to remove or empty the syslog file on Linux systems. Adversaries may clear or modify system logs to remove evidence of their activities, hindering incident response and forensic analysis. The rule specifically looks for 'rm' commands with various flags (e.g., -r, -f, -rf) and 'mv' commands targeting '/var/log/syslog', as well as redirection to empty the file ('>/var/log/syslog').
Detects the installation of suspicious packages using common Linux package managers (apt, yum, rpm, dpkg). The rule specifically looks for keywords associated with network scanning, sniffing, and proxy tools, which could indicate reconnaissance, network analysis, or attempts to bypass network controls by an adversary.
This rule detects access to specific '.lock' and '.pid' files in the '/var/run/' directory, which are known indicators of the BPFDoor backdoor. The rule specifically looks for access to 'haldrund.pid', 'xinetd.lock', and 'kdevrund.pid'.
Page 335 of 347