Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,420 detections
Filters
Last updated
All Time
Detection languages
530
348
171
163
130
Contributors
458
316
172
104
97
Categories
878
669
225
184
158
Platforms
1,332
232
184
47
31
Products / Services
10,680
9,761
6,694
4,418
3,744
1,420
MITRE Techniques
450
435
338
325
200
CVEs
28
22
10
9
7
This rule detects the use of the 'find' command on Linux systems with specific permission-related arguments. These arguments are often used by attackers during the discovery phase to locate files with unusual permissions, such as SUID/SGID binaries (-perm -4000, -perm -2000, -perm -u=s, -perm -g=s) which can be exploited for privilege escalation, or world-writable files (-perm 0777, -perm -222, -perm -o w) which could be used for persistence or data modification. It also looks for world-executable files (-perm -o x).
Detects suspicious child processes spawned from an interactive bash shell. This rule looks for specific command-line patterns (e.g., base64 encoding, pty.spawn for pseudo-terminal allocation) or specific executables (e.g., whoami, iptables, ncat/netcat) that are uncommon to be direct children of an interactive bash session, indicating potential malicious activity like reverse shells or reconnaissance.
Detects the execution of common shell interpreters (bash, csh, dash, fish, ksh, sh, zsh) where the parent process is located within the '/tmp/' directory. This behavior is often indicative of malware, such as GobRAT, dropping and executing malicious components in temporary locations to evade detection.
This rule detects the execution of the 'cat' command used to append a zip file to an image file. This technique is commonly used in steganography to hide data within seemingly innocuous files. The rule specifically looks for 'cat' being executed with two arguments: one ending in a common image file extension ('.jpg' or '.png') and another ending in '.zip'. This pattern suggests an attempt to concatenate the contents of a zip file onto an image file.
Detects changes to critical syslog daemon configuration files on Linux hosts. Adversaries may modify these files to disable or reconfigure logging, thereby impairing defenses and hindering the detection of their activities.
Detects the use of the 'steghide' utility to extract hidden files from image files (JPG or PNG). Adversaries may use steganography to conceal data and evade detection.
Detects the execution of netcat or ncat with the '-e' or '-c' flag, combined with common shell commands. This pattern is indicative of an attempt to establish a reverse shell, where a shell is spawned and connected back to an attacker-controlled listener.
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. This activity is indicative of the OMIGOD vulnerability exploitation.
This rule detects attempts to disable security tools on Linux systems. Specifically, it looks for command-line invocations of `iptables`, `ip6tables`, `firewalld`, `cbdaemon` (Carbon Black), `falcon-sensor` (CrowdStrike), and `setenforce` (SELinux) with arguments indicating a stop or disable action. This activity is often associated with adversaries attempting to impair defenses to facilitate further malicious actions.
Detects the execution of 'xterm' with command-line arguments indicative of a reverse shell connection, specifically looking for '-display' and a display value ending in ':1'. This pattern is commonly used by attackers to establish a reverse shell.
Detects attempts to collect image data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for 'xclip' execution with parameters indicating selection from the clipboard for image data output. It is highly recommended for server environments due to frequent legitimate clipboard utility usage on user workstations.
Detects attempts to overwrite or wipe files using the 'dd' command with '/dev/null' or '/dev/zero' as input. This technique is commonly used for data destruction, making files irrecoverable.
This rule detects attempts to masquerade as the Linux 'crond' process by copying '/bin/sh' to a file ending with '/crond' and executing it. This technique is often used by adversaries to evade detection by making malicious processes appear as legitimate system services.
This rule detects a suspicious command sequence often associated with the JexBoss exploitation tool. Specifically, it looks for the execution of 'bash -c /bin/bash' followed by a network connection attempt using '&/dev/tcp/'. This combination indicates an attempt to establish a reverse shell or exfiltrate data over TCP.
Detects the creation of the file "/tmp/rootlog" which is used by the TripleCross eBPF rootkit as a way to check if the backdoor is already running. This file acts as a lockfile to prevent multiple instances of the rootkit from running simultaneously.
Detects potential overwriting and deletion of a file using the 'dd' command. This rule specifically looks for executions of 'dd' where the output file ('of=') is specified and the input is either '/dev/zero' (writing zeros) or '/dev/null' (effectively truncating/deleting content). This pattern is commonly used for data destruction.
Detects the use of the 'chmod' command to modify file permissions in suspicious directory paths commonly used by malware for persistence or evasion. This rule specifically looks for chmod operations within '/tmp/', '/.Library/', '/etc/', and '/opt/' directories.
This rule detects attempts to change file or folder permissions and ownership on Linux systems by monitoring the execution of the 'chmod' and 'chown' commands. These commands are commonly used by adversaries to modify access controls, potentially to evade defenses, gain access to protected files, or establish persistence.
This rule detects the loading of kernel modules using the 'insmod' command. Loadable Kernel Modules (LKMs) are code segments that can be dynamically loaded into and unloaded from the kernel. Adversaries may leverage LKMs for establishing persistence, elevating privileges, or deploying kernel-mode rootkits, as they operate with the highest system privileges (Ring 0). The detection specifically looks for the execution of 'kmod' with the 'insmod' command.
This rule detects the use of the 'import' command, part of ImageMagick, to capture screenshots on a Linux system. It specifically looks for executions of 'import' where the arguments indicate a full-screen capture (using '-window root') or a general screenshot saved to a common image file format (PNG, JPG, JPEG). This activity is often associated with adversaries attempting to collect visual information from a compromised system.
Detects the use of the 'xwd' utility to capture screenshots on a Linux system. This rule is particularly relevant for server environments where screenshot utilities are less commonly used by legitimate users, reducing false positives. The detection logic specifically looks for 'xwd' execution with parameters indicating a screen capture, such as '-root' or '-out' followed by a file ending in '.xwd'.
Page 66 of 68