Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,420 detections
Filters
Last updated
All Time
Detection languages
530
348
171
163
130
Contributors
458
316
172
104
97
Categories
878
669
225
184
158
Platforms
1,332
232
184
47
31
Products / Services
10,680
9,761
6,694
4,418
3,744
1,420
MITRE Techniques
450
435
338
325
200
CVEs
28
22
10
9
7
Detects password policy discovery commands
Detects a Python process attempting to spawn a pseudo-terminal (TTY) using the `pty` module. This behavior is often indicative of an attacker establishing a reverse shell for interactive command execution on a compromised system. The rule specifically looks for Python executables and command-line arguments that import the `pty` module and call its `spawn` function.
This rule detects the execution of various known hacktools on Linux systems by monitoring process creation events and matching against a predefined list of tool names in the 'Image' field. The tools covered include C2 frameworks (e.g., Cobalt Strike, Metasploit, Havoc, Merlin, Sliver), network scanners (e.g., Nmap derivatives, Nuclei, Recon-ng), web enumeration tools (e.g., Dirb, Ffuf, Gobuster), web vulnerability scanners (e.g., Nikto, WPSCan), and other exploit/post-exploitation tools (e.g., Aircrack-ng, Bloodhound-Python, Hashcat, Hydra, John, SQLMap, PEASS-ng).
Detects the execution of common network scanning and reconnaissance tools on Linux systems. These tools are often used by adversaries to enumerate local or remote network services, identify open ports, and gather information about network topology and available hosts. The rule specifically looks for the execution of tools like netcat (when not in listen mode), nmap, hping, naabu, autorecon, and telnet.
Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.
Detects the use of "vim" and its sibling commands (rvim, vimdiff) to execute a shell or proxy commands. This behavior can be indicative of privilege escalation, unauthorized command execution, or attempts to break out of restricted environments by leveraging the capabilities of these text editors to run arbitrary commands or scripts (e.g., via :!/, :lua, :py, or direct shell calls).
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects suspicious modifications to sensitive or critical system files on Linux systems. This rule monitors for common command-line utilities (like 'cat', 'echo', 'grep', 'vi', 'nano', 'sed') being used with output redirection ('>') or directly to edit files within critical system directories and configuration files. This activity could indicate an attacker attempting to alter system behavior, maintain persistence, or escalate privileges by modifying files that are not expected to change without explicit administrative planning.
Detects attempts to change file time attributes on Linux systems using the 'touch' command with specific flags, which can be used by adversaries to hide new or modified files by making their timestamps appear legitimate. This technique is often referred to as timestomping.
This rule detects the execution of common network sniffing tools, specifically 'tcpdump' or 'tshark', when they are invoked with arguments indicating an attempt to capture network traffic from a specific interface. The rule looks for the '-c' argument (for count) and the '-i' argument (for interface) in the command line, which are typical indicators of active network sniffing.
This rule detects the execution of `iptables` commands that configure TCP port redirection, specifically looking for the `--to-ports 42` or `--to-ports 43` arguments. This behavior is associated with the BPFDoor malware, which uses iptables to redirect incoming traffic on a specific port (e.g., SSH port 22) to a different, often higher, port where its shell is listening, effectively bypassing firewall rules for the attacker's host.
Clear Linux Logs
Sigma
Detects attempts to clear logs on the system by identifying command-line executions of 'rm', 'shred', or 'unlink' targeting common log directories like '/var/log' and '/var/spool/mail'. Adversaries may clear system logs to hide evidence of an intrusion.
This rule detects suspicious command-line patterns indicative of reverse shell attempts. It looks for various common techniques used to establish a reverse shell, including bash, sh, netcat, socat, Perl, Python, Ruby, and PHP one-liners that connect back to an attacker-controlled host. The rule also includes patterns for xterm reverse shells and specific shell commands often used in conjunction with reverse shells.
Detects the installation of suspicious packages using common Linux package managers (apt, yum, rpm, dpkg). The rule specifically looks for keywords associated with network scanning, sniffing, and proxy tools, which could indicate reconnaissance, network analysis, or attempts to bypass network controls by an adversary.
This rule detects access to specific '.lock' and '.pid' files in the '/var/run/' directory, which are known indicators of the BPFDoor backdoor. The rule specifically looks for access to 'haldrund.pid', 'xinetd.lock', and 'kdevrund.pid'.
This rule detects attempts to delete history files, such as bash_history or zsh_history, on Linux systems. Adversaries often delete these files to remove traces of their activities and hinder forensic analysis. The rule specifically looks for process creation events where commands like 'rm', 'unlink', or 'shred' are used with command-line arguments indicating history files.
This rule detects command-line operations that target common shell history files on Linux systems. Adversaries often manipulate or delete these files to remove traces of their activities or to extract sensitive information like credentials that might have been typed into the command line. The rule specifically looks for execution events (`EXECVE`) that involve files such as `.bash_history`, `.zsh_history`, `.zhistory`, `.history`, `.sh_history`, and `fish_history`.
This rule detects attempts to enable BPF kprobes tracing on a Linux system. This is achieved by writing '1' to specific files within the '/sys/kernel/debug/tracing/events/kprobes/' directory, specifically targeting '/myprobe/enable' or '/myretprobe/enable'. This activity can be indicative of an attacker attempting to gain deep system visibility or to implement advanced evasion techniques.
This rule detects the use of 'dd' and 'truncate' commands to add junk data to a file, a technique adversaries may employ for binary padding to evade detection. Specifically, it looks for 'truncate' with the '-s' (size) option or 'dd' with 'if=' (input file) but without 'of=' (output file), indicating potential in-place modification or padding.
Detects the creation of a new user account on Linux systems. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. The rule specifically looks for 'SYSCALL' events where the executable ends with '/useradd' or 'ADD_USER' record types from auditd logs.
Page 63 of 68