Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,420 detections
Filters
Last updated
All Time
Detection languages
530
348
171
163
130
Contributors
458
316
172
104
97
Categories
878
669
225
184
158
Platforms
1,332
232
184
47
31
Products / Services
10,680
9,761
6,694
4,418
3,744
1,420
MITRE Techniques
450
435
338
325
200
CVEs
28
22
10
9
7
Detects commands that attempt to clear or tamper with the Linux command history. This technique is often used by threat actors to evade detection and execute commands without leaving a record in files like "bash_history" or "zsh_history". The rule specifically looks for various commands and patterns used to delete, truncate, or otherwise manipulate history files, as well as the specific log message "empty_bash_history" which can be generated by a provided monitoring script.
Detects the execution of 'wget' to download compressed files ('.zip' or '.rar') from 'temp.sh'. This activity has been observed in attacks attributed to UNC4841, specifically during their exploitation of Barracuda ESG zero-day vulnerabilities.
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule is particularly relevant for servers, where legitimate usage of clipboard utilities is less common than on user workstations. The rule specifically looks for the execution of 'xclip' with parameters '-sel', 'clip', and '-o', which are used to output the contents of the clipboard.
This rule detects command-line patterns indicative of reconnaissance activities on Linux systems, specifically searching for '.htpasswd' files which often contain credentials, and files with SUID/SGID permissions ('-perm -4000') which can be exploited for privilege escalation. These commands are commonly used by attackers to gather information about the system's configuration and potential credential storage locations.
This rule detects the execution of the 'split' command on Linux systems. The 'split' command is used to break a file into smaller pieces, which can be a technique used by adversaries to bypass data transfer size limits during exfiltration or to make files easier to transfer.
Detects a bash process initiating an outbound network connection to a remote IP address, which is a common indicator of a reverse shell. This rule specifically looks for '/bin/bash' processes making network connections, excluding connections to localhost or unspecified addresses.
This rule detects the execution of the `nohup` command on Linux systems. `nohup` is a utility that allows a command to continue running in the background even after the user logs out or the terminal is closed. Attackers may leverage `nohup` to maintain persistence for malicious processes or to bypass restrictions in certain environments.
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for the execution of 'xclip' with arguments indicating clipboard selection and output. It is highly recommended for server environments due to the frequent legitimate use of clipboard utilities on user workstations.
This rule detects the execution of common Linux commands used for system information discovery. Specifically, it looks for processes ending with '/uname', '/hostname', '/uptime', '/lspci', '/dmidecode', '/lscpu', and '/lsmod'. These commands are frequently used by adversaries to gather details about the operating system, hardware, and loaded modules on a compromised system.
Detects the use of the '--cpu-priority' command-line parameter, which is commonly associated with cryptocurrency miners, particularly XMRig, to prioritize CPU usage for mining operations. This can indicate the presence of coin mining malware on a system.
Detects the stopping of system firewall services (firewalld, iptables, ufw) on Linux systems. Adversaries may disable firewalls to bypass network controls, facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects various commands and file accesses indicative of system information discovery on Linux systems using auditd logs. It looks for access to common system release files like /etc/lsb-release, /etc/redhat-release, and /etc/issue. Additionally, it identifies the execution of commands such as 'uname', 'uptime', 'lsmod', 'hostname', and 'env'. The rule also flags 'grep' commands searching for virtualization indicators ('vbox', 'vm', 'xen', 'virtio', 'hv') and 'kmod list' commands, which are often used to enumerate loaded kernel modules.
This rule detects the execution of the `bpftrace` utility with the `--unsafe` option. The `bpftrace` tool is a high-level tracing language for Linux, and the `--unsafe` option allows it to perform operations that could potentially compromise system stability or security, such as writing to arbitrary memory locations or executing arbitrary code in the kernel. This usage could indicate an attempt to perform advanced system manipulation, potentially for privilege escalation, stealthy execution, or system compromise.
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.
This rule detects the execution of the 'unzip' command where the target file has a common image file extension ('.jpg' or '.png'). This behavior is indicative of an attempt to extract hidden information, specifically a zip archive, from an image file, a technique often used in steganography for defense evasion or data exfiltration.
Detects the execution of PHP CLI with the "-r" flag to run inline PHP code, specifically looking for calls to the "fsockopen" function. This combination is often used by attackers to create sockets for reverse shell connections, potentially in conjunction with functions like "exec" or "fopen". The rule also checks for common Unix shell names in the command line, indicating an attempt to spawn a shell.
Detects the execution of the 'curl' command on Linux systems when it includes options to set a custom user agent. This behavior can be indicative of command and control communication or data exfiltration attempts where an adversary tries to mimic legitimate web traffic or evade detection by changing the default user agent string.
Detects the execution of common Linux utilities used to discover system network connections and logged-in users. Specifically, it looks for 'who', 'w', 'last', 'lsof', and 'netstat' commands. It filters out legitimate calls from '/usr/bin/landscape-sysinfo' when 'who' is used.
Detects the usage of the 'usermod' command to add a user to either the 'root' or 'sudoers' group on a Linux system. This activity can indicate privilege escalation or persistence mechanisms by an attacker.
This rule detects the presence of base64 encoded shebangs (e.g., #!/bin/bash) within command-line arguments. Adversaries often encode commands to evade detection and obfuscate their malicious intent. The rule specifically looks for the base64 representations of common shell shebangs, indicating that a script or command containing these might be decoded and executed.
Detects the execution of the 'crontab -l' command, which is used to list scheduled cron jobs for the current user. This activity can be part of discovery tactics by adversaries to understand the system's scheduled tasks.
Page 65 of 68