Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects changes to critical syslog daemon configuration files on Linux hosts. Adversaries may modify these files to disable or reconfigure logging, thereby impairing defenses and hindering the detection of their activities.
Detects the use of the 'steghide' utility to extract hidden files from image files (JPG or PNG). Adversaries may use steganography to conceal data and evade detection.
Detects attempts to exploit the Shellshock vulnerability (CVE-2014-6271) by looking for specific shellshock expressions in log files. These expressions are commonly used to inject and execute arbitrary commands.
Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. These errors often suggest malformed requests or attempts to trigger vulnerabilities in the VSFTPD service.
Detects the creation of a new named pipe using the 'mkfifo' utility on Linux systems. Named pipes can be used for inter-process communication and can sometimes be leveraged by adversaries for various purposes, including data exfiltration, command and control, or as a component of more complex malware.
Detects the execution of netcat or ncat with the '-e' or '-c' flag, combined with common shell commands. This pattern is indicative of an attempt to establish a reverse shell, where a shell is spawned and connected back to an attacker-controlled listener.
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. This activity is indicative of the OMIGOD vulnerability exploitation.
This rule detects attempts to disable security tools on Linux systems. Specifically, it looks for command-line invocations of `iptables`, `ip6tables`, `firewalld`, `cbdaemon` (Carbon Black), `falcon-sensor` (CrowdStrike), and `setenforce` (SELinux) with arguments indicating a stop or disable action. This activity is often associated with adversaries attempting to impair defenses to facilitate further malicious actions.
Detects the execution of 'xterm' with command-line arguments indicative of a reverse shell connection, specifically looking for '-display' and a display value ending in ':1'. This pattern is commonly used by attackers to establish a reverse shell.
Detects potential Spring Expression Language (SpEL) Injection exploitation attempts, which can lead to Remote Code Execution (RCE). The rule specifically looks for the 'org.springframework.expression.ExpressionException' keyword in application error logs, indicating that an attempt to evaluate a malicious expression might have occurred or failed.
Detects attempts to collect image data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for 'xclip' execution with parameters indicating selection from the clipboard for image data output. It is highly recommended for server environments due to frequent legitimate clipboard utility usage on user workstations.
Detects attempts to overwrite or wipe files using the 'dd' command with '/dev/null' or '/dev/zero' as input. This technique is commonly used for data destruction, making files irrecoverable.
This rule detects attempts to masquerade as the Linux 'crond' process by copying '/bin/sh' to a file ending with '/crond' and executing it. This technique is often used by adversaries to evade detection by making malicious processes appear as legitimate system services.
This rule detects an anomaly in Apache Guacamole sessions where two users are simultaneously present in the same session. This could indicate unauthorized access, session hijacking, or a shared credential scenario that deviates from normal behavior.
Detects exploitation attempts related to the Nimbuspwn privilege escalation vulnerabilities (CVE-2022-29799 and CVE-2022-29800) on Linux systems. The rule looks for specific keywords that indicate the `networkd-dispatcher` service is being manipulated, potentially to execute arbitrary code with elevated privileges.
This rule detects a suspicious command sequence often associated with the JexBoss exploitation tool. Specifically, it looks for the execution of 'bash -c /bin/bash' followed by a network connection attempt using '&/dev/tcp/'. This combination indicates an attempt to establish a reverse shell or exfiltrate data over TCP.
Detects the creation of the file "/tmp/rootlog" which is used by the TripleCross eBPF rootkit as a way to check if the backdoor is already running. This file acts as a lockfile to prevent multiple instances of the rootkit from running simultaneously.
Detects potential overwriting and deletion of a file using the 'dd' command. This rule specifically looks for executions of 'dd' where the output file ('of=') is specified and the input is either '/dev/zero' (writing zeros) or '/dev/null' (effectively truncating/deleting content). This pattern is commonly used for data destruction.
Detects the execution of Ruby with the '-e' flag, which allows for inline script execution, combined with specific keywords related to socket programming ('rsocket', 'TCPSocket') and common shell names ('ash', 'bash', 'bsh', 'csh', 'ksh', 'pdksh', 'sh', 'tcsh'). This combination is a strong indicator of an attempt to establish a Ruby-based reverse shell.
This rule detects the use of the `wget` command-line utility to download files into potentially suspicious directories, specifically `/tmp/`. Adversaries often use `wget` for ingress tool transfer, downloading malicious payloads or additional tools to a compromised system. The rule looks for `wget` execution combined with the `-O` or `--output-document` flags, which specify an output file, and the presence of `/tmp/` in the command line, indicating a download to a common temporary directory often abused by attackers.
This rule detects a 'Segmentation Fault' error message in Apache error logs, indicating a crashing Apache worker process. This type of event can be caused by software vulnerabilities, misconfigurations, or malicious activity aiming to disrupt service availability.
Page 340 of 347