Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,418 detections
Filters
Last updated
All Time
Detection languages
529
347
171
163
130
Contributors
458
316
172
104
97
Categories
877
668
225
183
158
Platforms
1,330
232
183
47
31
Products / Services
10,650
9,755
6,688
4,418
3,745
1,418
MITRE Techniques
449
435
337
325
200
CVEs
28
22
10
9
7
The analytic detects the execution of GNU Octave with elevated privileges, specifically when it runs system commands via sudo. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments that include "octave-cli," "--eval," "system," and "sudo." This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute commands as root. If confirmed malicious, this could lead to full system compromise, enabling an attacker to gain root access and execute arbitrary commands, severely impacting system security and integrity.
The analytic identifies potential Linux persistence and privilege escalation activities by correlating risk scores and event counts from various Linux-related data sources. It focuses on behaviors associated with persistence and privilege escalation tactics. This activity is significant for a SOC because it highlights behaviors that could allow an attacker to maintain access or gain elevated privileges on a Linux system. If confirmed malicious, this activity could enable an attacker to execute code with higher privileges, persist in the environment, and potentially access sensitive information, posing a severe security risk.
The analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
The analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It specifically looks for the 'rm' command with force recursive deletion ('-rf') and the '--no-preserve-root' option. This activity indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage.
This analytic detects suspicious attempts to find private keys and certificates on Linux systems, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for files with common private key and certificate extensions using commands like 'find' or 'grep', this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information.
Detects the execution of known attacker tools, specifically those associated with the IronSharpPack toolset. This rule identifies process launches where common command and scripting interpreters (cmd.exe, python, ipy.exe, powershell.exe, pwsh.exe, wsl.exe) are used to execute scripts or binaries with names indicative of IronSharpPack components. The presence of these tools in an unauthorized environment suggests malicious activity, often related to offensive security operations, post-exploitation, or privilege escalation.
Detects programs that connect to known malware callback ports based on threat intelligence reports. This rule specifically targets Linux systems and filters out connections to common local IP ranges to reduce false positives.
Detects the execution of known attacker tools, including but not limited to those in the IronSharpPack toolset. These tools are commonly used for offensive security operations and may indicate malicious activity if observed in unauthorized environments.
Detects the creation of Python path configuration files (.pth) within Python library folders on Linux systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically looks for files ending with '.pth' in typical Python site-packages directories.
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used.
This may indicate an attacker attempting to leverage credentials they have obtained.
This may indicate an attacker attempting to leverage credentials they have obtained.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the execution of a shell as a sub-process of "rsync" without the expected command line flag "-e" being used. This behavior is commonly associated with attempts to exploit CVE-2024-12084, leading to arbitrary command execution or privilege escalation.
Detects the execution of command-line utilities such as 'kill', 'pkill', 'killall', or 'xkill' to terminate or send signals to running processes on a Linux system. This activity can be indicative of an adversary attempting to disrupt services, evade defenses, or clean up their tracks.
Detects enumeration of local system accounts on Linux. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. The rule identifies common commands and file accesses used for this purpose, such as 'lastlog', 'id', 'lsof -u', and utilities like 'cat', 'head', 'tail' accessing '/etc/passwd', '/etc/shadow', or '/etc/sudoers'.
This rule detects the execution of common Linux utilities used for process discovery. Adversaries often use these commands (atop, htop, pgrep, ps, pstree, top) to gather information about running processes on a system, which helps them understand the environment and plan subsequent actions. This information can reveal common software or applications running on systems within the network.
Detects attempts to discover password policy information on Linux systems by monitoring access to key configuration files and the execution of 'chage' and 'passwd' commands with specific arguments.
Detects the use of common Linux utilities such as 'find', 'tree', 'findmnt', 'ls -R', and 'mlocate' for discovering files, directories, and potentially network shares. This activity is often performed by adversaries to gain situational awareness of the file system.
Detects password policy discovery commands
Detects a Python process attempting to spawn a pseudo-terminal (TTY) using the `pty` module. This behavior is often indicative of an attacker establishing a reverse shell for interactive command execution on a compromised system. The rule specifically looks for Python executables and command-line arguments that import the `pty` module and call its `spawn` function.
Page 62 of 68