Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,418 detections
Filters
Last updated
All Time
Detection languages
529
347
171
163
130
Contributors
458
316
172
104
97
Categories
877
668
225
183
158
Platforms
1,330
232
183
47
31
Products / Services
10,650
9,755
6,688
4,418
3,745
1,418
MITRE Techniques
449
435
337
325
200
CVEs
28
22
10
9
7
Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations
Detects relevant commands often related to malware or hacking activity
Detects commandline operations on shell history files
Detects the start, reload or restart of a service.
Audio Capture
Sigma
Detects attempts to record audio using the arecord and ecasound utilities.
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects system information discovery commands
Detects a creation of systemd services which could be used by adversaries to execute malicious code.
Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Detects enumeration of local or remote network services.
Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
Detects common shell processes launching a reverse shell using the '/dev/tcp' redirection. This technique is known to be used by adversaries like the Clop ransomware group for persistence and command and control.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux. This includes using the `personality` syscall with the ADDR_NO_RANDOMIZE flag, modifying the `/proc/sys/kernel/randomize_va_space` file, or executing the `sysctl` command to set `kernel.randomize_va_space=0`. Disabling ASLR can be used by attackers to bypass memory protection mechanisms and make memory corruption attacks more reliable, often during exploit development.
Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.
This rule detects the execution of Python web servers via the command line interface (CLI) on Linux systems. Adversaries often use Python's built-in HTTP server modules (like `http.server` or `SimpleHTTPServer`) in post-exploitation scenarios to quickly establish a web server without needing to install additional software. This allows them to easily transfer files between a compromised host and attacker-controlled systems, facilitating data exfiltration or further payload delivery.
Detects the creation of a new user account with privileged User ID (UID) or Group ID (GID) on Linux systems, specifically targeting root (UID=0, GID=0), wheel (GID=10), or sudo (GID=27) groups. This rule monitors logs for `useradd` events indicating the creation of users with these elevated privileges.
This rule detects the execution of TruffleHog, a tool designed to find secrets in various platforms such as Git, GitHub, Jira, Slack, Confluence, SharePoint, Docker images, and cloud storage services like S3 and GCS. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. The rule triggers on either the image name ending with '/trufflehog' or a combination of command-line arguments indicating its use to scan specific platforms and the '--results=verified' flag.
Page 53 of 68