Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,214
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,781
7,128
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the usage of the unsafe bpftrace option
Crontab Enumeration
Sigma
Detects usage of crontab to list the tasks of the user
Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
Detects execution of binaries located in potentially suspicious locations via "nohup"
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity
Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets.
Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.
Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.
Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell
Detects usage of system utilities (only grep and egrep for now) to discover security software discovery
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
Detects a suspicious curl process start on linux with set useragent options
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Detects java process spawning suspicious children
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Detects usage of "xterm" as a potential reverse shell tunnel
Detects an issue in apache logs that reports threading related errors
Nginx Core Dump
Sigma
Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Detects potential SQL injection attempts via GET requests in access logs.
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
This rule detects the ChinaZ trojan by identifying specific byte patterns associated with its functionalities. These functionalities include collecting system information, sending system information, parsing C2 commands, and performing DNS flood attacks. The rule contains distinct byte patterns for both 32-bit and 64-bit architectures of the malware.
Page 337 of 340