Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects attempts to force stop the Uncomplicated Firewall (ufw) using the 'ufw-init' script with the 'force-stop' argument, or disabling ufw using the 'ufw disable' command. This activity can indicate an adversary attempting to bypass host-based firewall controls to facilitate network communications for C2, lateral movement, or data exfiltration.
Detects the usage of utilities such as 'systemctl', 'service', and 'chkconfig' to stop or disable services on a Linux system. This activity can be indicative of an adversary attempting to impair defenses or disrupt system operations.
Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
This rule detects a specific threading-related error message in Apache HTTP Server error logs. The error message indicates an issue with priority changes for pthreads, specifically an assertion failure related to `__pthread_tpp_change_priority`. This could be indicative of an underlying problem with the Apache server's threading model, potentially caused by misconfigurations, incompatible modules, or resource exhaustion. While the rule itself doesn't directly detect an attack, such errors could be exploited or could be a symptom of a system under stress or compromise.
Detects potential exploitation attempts targeting the Cacti Command Injection vulnerability, CVE-2022-46169. The rule looks for specific patterns in GET requests to '/remote_agent.php' with 'action=polldata' and 'poller_id=' in the query, combined with suspicious command injection payloads like 'base64 -d | /bin/bash', 'whoami', 'powershell', 'cmd', or 'wget'.
Detects the use of the 'steghide' binary with the 'embed' command and specific flags ('-cf' or '-ef') to hide files using steganography. This technique can be used by adversaries to embed malicious payloads or sensitive data within legitimate-looking files, such as images, to evade detection.
Detects disabling security tools
Detects the creation of shell scripts (files ending with .csh or .sh) within the '/etc/profile.d/' directory. This directory is used to store shell scripts that are executed when a user logs in, making it a common target for adversaries to establish persistence or elevate privileges.
Detects the use of the 'wget' utility to download and create files within common temporary directories like '/tmp' or '/var/tmp' on Linux systems. This activity can be indicative of an adversary performing ingress tool transfer or staging malicious files.
This rule detects the use of the 'grep' command on Linux systems to identify information about the operating system's architecture. Adversaries often combine this activity with other discovery commands like 'uname' or 'cat /proc/cpuinfo' to gather system details. The rule specifically looks for 'grep' executions where the command line arguments include common architecture strings such as 'aarch64', 'arm', 'i386', 'i686', 'mips', or 'x86_64'. This activity is indicative of an attacker attempting to understand the environment they have compromised.
Detects attempts to exploit the VMware Workspace ONE Access Admin Remote Code Execution vulnerability (CVE-2022-31659) by monitoring for POST requests to the '/SAAS/jersey/manager/api/migrate/tenant' URI. This URI is associated with the migration API, and suspicious activity here could indicate an attacker attempting to leverage the vulnerability for remote code execution.
Detects the usage of the 'base64' utility with the decode flag ('-d' or '--decode') on Linux systems. This activity can indicate an adversary attempting to deobfuscate or decode base64-encoded text, which is a common technique for hiding malicious payloads or commands.
Detects potential OGNL Injection exploitation, which may lead to RCE.
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location
Detects the enumeration of other remote systems.
Detects system information discovery commands
Detects usage of the "usermod" binary to add users add users to the root or suoders groups
Detects potential local file read vulnerability in JVM based apps.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
Detects process execution related exceptions in JVM based apps, often relates to RCE
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Page 342 of 347