Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Detects java process spawning suspicious children
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Detects usage of "xterm" as a potential reverse shell tunnel
Detects suspicious shell commands used in various Equation Group scripts and tools
Detects specific commands commonly used to remove or empty the syslog
Detects suspicious shell commands used in various exploit codes (see references)
Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell
Symlink Etc Passwd
Sigma
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"
Detects execution of the bash shell with the interactive flag "-i".
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Detects command line parameters or strings often used by crypto miners
Curl Usage on Linux
Sigma
Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server
DD File Overwrite
Sigma
Detects potential overwriting and deletion of a file using DD.
Detects the use of grep to discover specific files created by the GobRAT malware
Nohup Execution
Sigma
Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments
Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.
Script being executed gets created as a temp file in /tmp folder with a scx* prefix.
Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.
The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Script being executed gets created as a temp file in /tmp folder with a scx* prefix.
Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.
The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Detects events with patterns found in commands used for reconnaissance on linux systems
Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.
Detects usage of system utilities to discover system network connections
Page 50 of 51