Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,418 detections
Filters
Last updated
All Time
Detection languages
529
347
171
163
130
Contributors
458
316
172
104
97
Categories
877
668
225
183
158
Platforms
1,330
232
183
47
31
Products / Services
10,650
9,755
6,688
4,418
3,745
1,418
MITRE Techniques
449
435
337
325
200
CVEs
28
22
10
9
7
Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
This analytic detects the execution of commands to start or enable services on Linux systems. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
The analytic detects outbound network connections from an endpoint process to suspicious or non-standard ports. It uses Cisco Network Visibility Module flow data to identify processes communicating over ports like 4444, 2222, or 51820, which are commonly associated with tools such as Metasploit, SliverC2, other penetration testing tools, red team activities, or malware. These connections warrant further investigation, especially when initiated by unexpected or non-network-native binaries.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system. Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging. Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
This rule detects the execution of any process that originates from the '/tmp/' directory on a Linux system. The '/tmp/' directory is often used by adversaries to stage and execute malicious payloads, as it is typically writable by all users and can be used to bypass certain security controls. The rule specifically excludes executions of '/usr/bin/nextcloud' from '/tmp/' to reduce false positives.
Detects the execution of a malicious Linux payload, possibly within a .desktop file, a technique used by APT36. The rule identifies a bash process executing an inline command that downloads and runs a payload, often using a combination of curl, xxd, base64, and eval.
The analytic detects the installation of a Linux kernel module using the `modprobe` utility. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Detects the use of GCC (or C89/C99) with the '-wrapper' option to execute a shell, which can be leveraged for privilege escalation, unauthorized command execution, or to break out from restricted environments. This technique is often documented in resources like GTFOBins.
Detects the use of the 'find' command in Linux to execute a shell. This behavior is often associated with privilege escalation, unauthorized command execution, or exploitation attempts, particularly when leveraging misconfigurations or vulnerabilities to break out of restricted environments.
Detects the use of the "ssh" utility to execute a shell, which can indicate privilege escalation, unauthorized command execution, or breakout from restricted environments. The rule specifically looks for `ssh` commands that include `ProxyCommand=;`, `permitlocalcommand=yes`, or `localhost` in conjunction with common shell invocations like `/bin/bash`, `/bin/sh`, etc.
Detects the execution of 'awk' or its sibling commands (gawk, mawk, nawk) to invoke a shell using the `system()` function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. The rule specifically looks for 'git' as the parent process, combined with command-line arguments '-p' and 'help', and a child process command line containing 'bash 0<&1', 'dash 0<&1', or 'sh 0<&1'. This pattern is indicative of exploiting git's interactive help functionality to spawn a shell.
This rule detects the execution of inline Python code that uses the `os.system()` function to spawn a shell. Specifically, it looks for Python interpreter executables being run with the `-c` argument (for inline code execution) and the command line containing both `os.system(` and common shell paths like `/bin/bash`, `/bin/sh`, etc. This technique is often used by adversaries to gain interactive shell access or execute arbitrary commands on a compromised system.
Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
The following analytic detects the suspicious add user account type. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
This analytic detects new UDP communication between a source and destination workload pair within a Kubernetes cluster. It uses Network Performance Monitoring (NPM) metrics from an OTEL collector via Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to identify new inter-workload communication. Such changes in network behavior can indicate potential security threats or anomalies, including unauthorized connections that may lead to data breaches, privilege escalation, lateral movement, or disruption of critical services.
This rule detects the creation of hidden files or directories on Linux systems. It specifically looks for common commands like 'mkdir', 'nano', 'touch', 'vi', or 'vim' being executed with arguments that start with a '.' (dot), which is the standard convention for hidden files and directories in Unix-like operating systems. This behavior is often used by adversaries for defense evasion.
Page 56 of 68