Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects the use of archive utilities (tar, zip, 7z, gzip, zstd) to bundle sensitive PeopleSoft configuration and application directories (e.g., ps_config_homes, psoft/psft). This behavior is consistent with data staging for exfiltration, frequently associated with the ShinyHunters threat group activity targeting exposed PeopleSoft environments.
Detects the use of the zstd compression utility on PeopleSoft application servers by privileged service accounts such as psoft, oracle, or linuxadm. This behavior is indicative of data staging or archiving activity consistent with ShinyHunters pre-exfiltration tactics.
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
Detects potential RondoDox botnet infection attempts by monitoring for the execution of common command-line tools (wget, busybox, curl) using specific flags (-qO-, -s) to download and pipe remote scripts from the known C2 IP 45.92.1.50 directly into a shell interpreter for execution.
Identifies shell commands associated with downloading architecture-specific payloads (e.g., mips, mipsel) commonly used by IoT/SOHO botnet droppers like the JDY botnet.
Detects instances where an executable is deleted immediately after execution, a common defense evasion technique used by memory-resident malware like the JDY botnet. This rule specifically looks for shell processes executing 'chmod +x' or 'chmod 777' followed by 'rm' commands, often chained with '&&', ';', or '||', indicating immediate self-deletion after execution.
This rule detects suspicious access to the UniFi OS JWT secret file (jwt.yaml) by processes other than the legitimate UniFi core components. It monitors for direct file access events (read, copy) and command-line executions that target the jwt.yaml file. This activity could indicate an attempt to extract sensitive credentials, potentially leading to unauthorized access or privilege escalation within the UniFi environment.
This rule detects potential privilege escalation attempts on UniFi OS systems where the 'ucs-update' service account uses 'sudo' to execute sensitive commands like 'dpkg', 'chmod', or 'systemctl'. This behavior is indicative of the vulnerability described in the Bishop Fox research, where an unauthenticated RCE chain can lead to root escalation.
UFW Disable Attempt
Sigma
Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the execution of the 'tee' command via sudo, potentially indicating local privilege escalation. This activity has been observed in VerdantBamboo campaigns exploiting a sudo misconfiguration for the 'egnyteservice' account on Egnyte Storage Sync systems.
Linux Pam Modification
YARA-L
Detects modifications to Linux PAM configuration files or module directories, potentially indicating PAM backdoor installation such as PamDOORa. Assigns higher risk for unusual processes or multiple file modifications.
Detects the execution of the public Dirty Frag exploit tool by monitoring for its hardcoded command-line arguments (--force-esp, --force-rxrpc). This vulnerability allows local attackers to gain root privileges via page-cache tampering in the Linux kernel without race conditions.
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
Detects authentication or privilege escalation events where a user account that is normally unprivileged suddenly reports as UID 0. This is a direct artifact of modifying the page cache of /etc/passwd in memory, which is the primary post-exploitation phase of the Copy Fail vulnerability (CVE-2026-31431).
This rule detects attempts to stop or disable critical system services and security mechanisms on Linux systems,.Adversaries may attempt to disable these services to impair defenses, remove logging capabilities, or bypass security controls.
Detects chmod usage that sets SUID or SGID bits, which can be abused for privilege escalation.
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
Detects changes to the ESXi syslog configuration via "esxcli"
Detects suspicious process command line that uses base64 encoded input for execution with a shell
Page 39 of 51