Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.
Detects potential exploitation attempts of CVE-2023-2283, an authentication bypass vulnerability in libSSH. The exploitation method causes an error message indicating that keys for curve25519 could not be generated. This error message serves as a sign of an exploitation attempt, not necessarily a successful exploitation.
This rule detects the execution of specific binaries identified as being used by the UNC4841 threat group to deploy the SEASPY backdoor. The binaries include 'BarracudaMailService', 'resize2fstab', and 'resize_reisertab'. Detection is based on the image path ending with any of these specific names.
This rule detects the execution of the 'unzip' command where the target file has a common image file extension ('.jpg' or '.png'). This behavior is indicative of an attempt to extract hidden information, specifically a zip archive, from an image file, a technique often used in steganography for defense evasion or data exfiltration.
Detects the execution of PHP CLI with the "-r" flag to run inline PHP code, specifically looking for calls to the "fsockopen" function. This combination is often used by attackers to create sockets for reverse shell connections, potentially in conjunction with functions like "exec" or "fopen". The rule also checks for common Unix shell names in the command line, indicating an attempt to spawn a shell.
Detects the creation or modification of scheduled cron jobs where the command line argument contains '/tmp/'. This behavior is often indicative of an adversary attempting to establish persistence or execute malicious code from a temporary directory using the cron utility.
Detects the execution of the 'curl' command on Linux systems when it includes options to set a custom user agent. This behavior can be indicative of command and control communication or data exfiltration attempts where an adversary tries to mimic legitimate web traffic or evade detection by changing the default user agent string.
Detects the execution of common Linux utilities used to discover system network connections and logged-in users. Specifically, it looks for 'who', 'w', 'last', 'lsof', and 'netstat' commands. It filters out legitimate calls from '/usr/bin/landscape-sysinfo' when 'who' is used.
Detects the usage of the 'usermod' command to add a user to either the 'root' or 'sudoers' group on a Linux system. This activity can indicate privilege escalation or persistence mechanisms by an attacker.
This rule detects the presence of base64 encoded shebangs (e.g., #!/bin/bash) within command-line arguments. Adversaries often encode commands to evade detection and obfuscate their malicious intent. The rule specifically looks for the base64 representations of common shell shebangs, indicating that a script or command containing these might be decoded and executed.
Detects the execution of the 'crontab -l' command, which is used to list scheduled cron jobs for the current user. This activity can be part of discovery tactics by adversaries to understand the system's scheduled tasks.
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity.
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity. This rule looks for specific patterns in the command line arguments that indicate an attempt to establish a reverse shell using Perl's networking capabilities.
Detects the use of the 'chmod' command to modify file permissions in suspicious directory paths commonly used by malware for persistence or evasion. This rule specifically looks for chmod operations within '/tmp/', '/.Library/', '/etc/', and '/opt/' directories.
This rule detects the use of the 'find' command on Linux systems with specific permission-related arguments. These arguments are often used by attackers during the discovery phase to locate files with unusual permissions, such as SUID/SGID binaries (-perm -4000, -perm -2000, -perm -u=s, -perm -g=s) which can be exploited for privilege escalation, or world-writable files (-perm 0777, -perm -222, -perm -o w) which could be used for persistence or data modification. It also looks for world-executable files (-perm -o x).
Detects suspicious child processes spawned from an interactive bash shell. This rule looks for specific command-line patterns (e.g., base64 encoding, pty.spawn for pseudo-terminal allocation) or specific executables (e.g., whoami, iptables, ncat/netcat) that are uncommon to be direct children of an interactive bash session, indicating potential malicious activity like reverse shells or reconnaissance.
Detects the execution of common shell interpreters (bash, csh, dash, fish, ksh, sh, zsh) where the parent process is located within the '/tmp/' directory. This behavior is often indicative of malware, such as GobRAT, dropping and executing malicious components in temporary locations to evade detection.
Detects the execution of the 'execve_hijack' component of the Triple Cross eBPF rootkit. This specific file is used by the rootkit to elevate privileges by hijacking the 'execve' system call, often in conjunction with the 'sudo' command.
This rule detects the execution of specific commands associated with the installation of the Triple Cross eBPF rootkit. It looks for commands executed via 'sudo' that contain specific 'tc' (traffic control) parameters, including 'qdisc' and 'filter', along with a network interface like 'enp0s3'. These command line arguments are characteristic of the 'deployer.sh' script used by the Triple Cross rootkit to establish persistence and hide its presence using eBPF.
This rule detects various suspicious exceptions within Django web applications. These exceptions, such as 'SuspiciousOperation' and its subclasses (e.g., 'DisallowedHost', 'InvalidSessionKey', 'RequestDataTooBig'), as well as 'PermissionDenied', often indicate attempts to exploit vulnerabilities, bypass security controls, or engage in other malicious activities against the web application. Monitoring these exceptions can help identify potential attacks like web parameter tampering, session hijacking attempts, or unauthorized access attempts.
This rule detects the execution of the 'cat' command used to append a zip file to an image file. This technique is commonly used in steganography to hide data within seemingly innocuous files. The rule specifically looks for 'cat' being executed with two arguments: one ending in a common image file extension ('.jpg' or '.png') and another ending in '.zip'. This pattern suggests an attempt to concatenate the contents of a zip file onto an image file.
Page 339 of 347