Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,418 detections
Filters
Last updated
All Time
Detection languages
529
347
171
163
130
Contributors
458
316
172
104
97
Categories
877
668
225
183
158
Platforms
1,330
232
183
47
31
Products / Services
10,650
9,755
6,688
4,418
3,745
1,418
MITRE Techniques
449
435
337
325
200
CVEs
28
22
10
9
7
The following analytic identifies the creation of cloud compute instances by users who have not previously created them. It leverages data from the Change data model, focusing on 'create' actions by users, and cross-references with a baseline of known user activities. This activity is significant as it may indicate unauthorized access or misuse of cloud resources by new or compromised accounts. If confirmed malicious, attackers could deploy unauthorized compute instances, leading to potential data exfiltration, increased costs, or further exploitation within the cloud environment.
Detects the use of command-line tools such as 'scp', 'rsync', and 'sftp' that are commonly used to copy files to or from remote systems. This activity can be indicative of an adversary transferring tools into an environment (Ingress Tool Transfer) or moving files laterally within a compromised network (Lateral Tool Transfer). The rule specifically looks for the presence of these tool names followed by a space and then a colon or an '@' symbol, which are characteristic of remote file operations.
Detects the use of the `syslog` syscall with action codes 4, 5, or 6, which can clear or disable the kernel ring buffer (dmesg logs). This technique can be used by attackers to hide traces after exploitation or privilege escalation. A common method is running `dmesg -c`, which internally triggers this syscall.
This rule detects attempts to enumerate local system groups on Linux. Adversaries often perform this discovery technique to understand the environment and identify users with elevated permissions. The rule triggers on execution of the 'groups' command or on common file viewing utilities (cat, ed, head, less, more, nano, tail, vi, vim) when they are used to read the '/etc/group' file.
Detects the execution of common text-based file access or inspection utilities to read the content of the '/etc/sudoers' file on Linux systems. This activity is often performed by adversaries to discover users with sudo rights, which can be a precursor to privilege escalation.
Detects attempts to record audio using the `arecord` and `ecasound` utilities on Linux systems. This rule specifically looks for the execution of `arecord` with common audio recording flags (`-vv`, `-fdat`) or the `ecasound` utility making a `memfd_create` syscall, which could indicate audio processing or recording.
Detects possible command execution by a web application or web shell by monitoring `execve` and `execveat` syscalls initiated by the web server's user ID (e.g., euid 33 for www-data). This rule specifically targets Linux systems using auditd for logging, requiring a specific auditd configuration to capture these events.
Detects the use of the `sysinfo` system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage `sysinfo` to fingerprint the system, gathering data to determine if it's a viable target.
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", "last", "uname", "users", "w", and "who" on Linux systems. Adversaries use these commands to gather information about the system and its users to inform subsequent actions.
This rule detects attempts to create or rename files with a space at the end of their filename, which can be used to obfuscate malicious files or commands. Specifically, it looks for command-line executions involving 'echo "*" > * && chmod +x *' or 'mv * "* "'. The first pattern suggests creating an executable file with a trailing space, and the second suggests renaming a file to include a trailing space.
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
Detects enumeration of Kubernetes secrets.
Detects attempts to inject a sidecar container into a running deployment.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
Detects the execution of the "esxcli" command with the "vm" and "kill" flags, indicating an attempt to terminate or shut down a specific virtual machine on an ESXi hypervisor. This activity can be indicative of malicious actions such as ransomware attacks targeting virtualized environments.
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
Detects when a Kubernetes Rolebinding is created or modified.
Detects when Kubernetes Secrets are Modified or Deleted.
Detects the removal of a deployment from a Kubernetes cluster.
This could indicate disruptive activity aiming to impact business operations.
This could indicate disruptive activity aiming to impact business operations.
Detects creation of a container with a hostPath mount.
A hostPath volume mounts a directory or a file from the node to the container.
Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.
A hostPath volume mounts a directory or a file from the node to the container.
Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.
Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks.
A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.
Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields
A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.
Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields
Page 58 of 68