Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,420 detections
Filters
Last updated
All Time
Detection languages
530
348
171
163
130
Contributors
458
316
172
104
97
Categories
878
669
225
184
158
Platforms
1,332
232
184
47
31
Products / Services
10,680
9,761
6,694
4,418
3,744
1,420
MITRE Techniques
450
435
338
325
200
CVEs
28
22
10
9
7
Detects the execution of the 'groupdel' command, which is used to delete a group on Linux systems. This activity can be abused by threat actors to remove evidence of their presence or to disrupt legitimate user access by deleting groups.
Detects the removal of packages on Linux systems using common package managers such as 'yum', 'apt', 'apt-get', 'dpkg', and 'rpm'. This activity could be indicative of an adversary attempting to remove forensic artifacts or security tools.
Detects potential container discovery by monitoring for common Linux utilities (awk, cat, grep, head, less, more, nl, tail) being used to read specific files within the '/proc' virtual filesystem. Specifically, it looks for access to '/proc/2/' (which would typically be kthreadd outside a container) or '/proc/cgroup' and '/proc/sched' which can reveal containerized environments due to differences in their content or PID mappings.
This rule detects the execution of programs from suspicious directories on Linux systems. These directories are commonly used by malware or attackers for staging and executing malicious payloads, including temporary folders, web server directories, and data directories of typically exploited services like PostgreSQL, MySQL, and FTP. The rule specifically looks for SYSCALL events where the executable path starts with one of the predefined suspicious paths.
Detects the execution of the 'curl' command on Linux systems. This typically indicates an attempt to download files from a remote location or make web requests to external servers. This activity can be associated with adversaries transferring tools or communicating with command and control infrastructure.
Detects attempts to exfiltrate data by posting a file using the `wget` utility. This can be particularly dangerous if an adversary leverages misconfigured sudo permissions for `wget` to read sensitive files like `/etc/shadow` and then exfiltrate them.
This rule detects attempts to extract passwords from files on Linux systems using the 'grep' command. It specifically looks for executions of 'grep' in conjunction with the keyword 'password', indicating a potential search for credentials.
This rule detects suspicious command-line executions that attempt to create symbolic links to the `/etc/passwd` file. Attackers might do this to gain unauthorized access to user account information, potentially leading to credential dumping or privilege escalation. The rule specifically looks for `ln -s /etc/passwd` and `ln -s -f /etc/passwd` patterns in command lines.
This rule detects attempts to copy the 'passwd' or 'shadow' files from the '/tmp/' directory using the 'cp' command. This activity is highly suspicious as these files contain sensitive user account information, including password hashes (in the case of 'shadow'), and should not typically be copied to temporary directories. An adversary might do this to exfiltrate credentials for offline cracking or to move them to a location accessible for further exploitation.
Detects suspicious command executions on Linux systems, specifically focusing on modifications to file permissions (chmod 777, chmod u+s) and copying of shell binaries (/bin/ksh, /bin/sh). These actions are often associated with malware or hacking activities, such as privilege escalation or establishing persistence.
Detects the installation of new root certificates on a Linux system. Attackers may install root certificates to bypass security warnings when connecting to adversary-controlled web servers or C2 infrastructure, making their malicious traffic appear legitimate. This rule specifically looks for the execution of common Linux utilities used for managing CA certificates: 'update-ca-certificates' and 'update-ca-trust'.
This rule detects the execution of the 'git clone' command on Linux systems when the command line arguments contain suspicious keywords. These keywords are indicative of activities related to exploits, vulnerabilities, remote code execution (RCE), or proof-of-concept (PoC) code for known vulnerabilities like ProxyShell, Log4Shell, and EternalBlue. The rule aims to identify attempts by adversaries to download malicious or exploit-related code from remote repositories.
This rule detects changes to critical Linux auditd configuration files. Adversaries may modify these files to disable or alter auditing, thereby hindering detection of their malicious activities. Monitoring these files for changes can help identify attempts to evade security monitoring.
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location, specifically within the /tmp/ directory. Named pipes can be used for inter-process communication and their creation in temporary directories might indicate malicious activity such as local privilege escalation or data exfiltration.
Detects the execution of the 'userdel' binary, which is used to delete a user account and associated files. This activity can be abused by threat actors to remove accounts, hindering forensic analysis and covering their tracks.
Detects the execution of 'wget' to download a '.tar' file from an untrusted direct IP address, specifically when the '--no-check-certificate' flag is used. This behavior has been observed in attacks attributed to UNC4841 during their exploitation of Barracuda ESG zero-day vulnerabilities.
This rule detects attempts to shut down or reboot a Linux system using common commands like 'shutdown', 'reboot', 'halt', 'poweroff', or by using 'init' or 'telinit' with specific runlevel arguments (0 for halt/shutdown, 6 for reboot). Adversaries may use these methods to disrupt system availability or aid in the destruction of data.
Detects the execution of binaries located in potentially suspicious locations, specifically within the '/tmp/' directory, using the 'nohup' command. This behavior is often associated with malware attempting to maintain execution even after a user logs off or a session terminates.
Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. This behavior is often associated with malware or adversaries attempting to execute payloads from temporary or user-writable directories.
This rule detects attempts to enumerate local network configuration on Linux systems. It specifically looks for the execution of common network utilities such as 'firewall-cmd', 'ufw', 'iptables', 'netstat', 'ss', 'ip', 'ifconfig', 'systemd-resolve', and 'route'. Additionally, it triggers if '/etc/resolv.conf' is present in the command line, indicating an attempt to inspect DNS resolver configuration.
Detects the execution of common network scanning or service enumeration tools like telnet, nmap, and netcat on Linux systems, as captured by auditd logs. This activity can indicate an adversary attempting to discover local or remote network services.
Page 64 of 68