Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,420 detections
Filters
Last updated
All Time
Detection languages
530
348
171
163
130
Contributors
458
316
172
104
97
Categories
878
669
225
184
158
Platforms
1,332
232
184
47
31
Products / Services
10,680
9,761
6,694
4,418
3,744
1,420
MITRE Techniques
450
435
338
325
200
CVEs
28
22
10
9
7
This rule detects the execution of the 'grep' command on Linux systems when it is used to search for specific filenames associated with the GobRAT malware. The filenames include 'apached', 'frpc', 'sshd.sh', and 'zone.arm'. This activity indicates that an attacker, potentially using GobRAT, is attempting to discover files related to their malware deployment or persistence mechanisms.
Detects the use of `iptables` or `ip6tables` commands to flush all firewall rules, tables, and chains, potentially allowing all network traffic. This action is often performed by adversaries to impair defenses and bypass network restrictions.
This rule detects the execution of a script via the SCX RunAsProvider ExecuteScript function, which is associated with the OMIGOD vulnerability. Specifically, it looks for process creation events where the user is 'root', the LogonId is '0', the CurrentDirectory is '/var/opt/microsoft/scx/tmp', and the CommandLine contains '/etc/opt/microsoft/scx/conf/tmpdir/scx'. This pattern indicates the execution of a temporary script created by the SCX agent, often exploited for privilege escalation or initial access.
Detects the use of 'arp -a' or 'ping' commands targeting common private and loopback IP address ranges on Linux systems, which can indicate an adversary performing remote system discovery.
This rule detects attempts to remove the immutable file attribute on Linux systems using the 'chattr' command with the '-i' flag. The immutable attribute prevents a file from being modified, deleted, or renamed, even by the root user. Adversaries may remove this attribute to modify critical system files or logs for defense evasion purposes.
This rule detects attempts to gather system and hardware information on Linux systems by monitoring access to specific files and directories that contain details about the BIOS version, product name, chassis vendor, SCSI devices, IDE hard drive models, kernel version, and operating system release information. Adversaries often access these files during the discovery phase to understand the environment they have compromised.
This rule detects outbound network connections from a Linux system to known Monero crypto mining pools. The detection is based on a predefined list of destination hostnames associated with various Monero mining operations. This activity is indicative of resource hijacking, where a system's computational resources are illicitly used for cryptocurrency mining.
This rule detects the usage of the 'chattr' utility with the '-i' flag to remove the immutable file attribute on Linux systems. Removing this attribute can allow adversaries to modify or delete critical system files that were previously protected, often as a defense evasion technique to hinder forensic analysis or remove persistence mechanisms.
Detects attempts to exploit Apache Spark shell command injection vulnerabilities, specifically CVE-2022-33891, by monitoring for suspicious command-line executions involving 'id -Gn' as a child process of a bash shell. This indicates an attacker successfully injecting commands into the Spark environment.
Detects attempts to force stop the Uncomplicated Firewall (ufw) using the 'ufw-init' script with the 'force-stop' argument, or disabling ufw using the 'ufw disable' command. This activity can indicate an adversary attempting to bypass host-based firewall controls to facilitate network communications for C2, lateral movement, or data exfiltration.
Detects the use of the 'steghide' binary with the 'embed' command and specific flags ('-cf' or '-ef') to hide files using steganography. This technique can be used by adversaries to embed malicious payloads or sensitive data within legitimate-looking files, such as images, to evade detection.
This rule detects the use of the 'grep' command on Linux systems to identify information about the operating system's architecture. Adversaries often combine this activity with other discovery commands like 'uname' or 'cat /proc/cpuinfo' to gather system details. The rule specifically looks for 'grep' executions where the command line arguments include common architecture strings such as 'aarch64', 'arm', 'i386', 'i686', 'mips', or 'x86_64'. This activity is indicative of an attacker attempting to understand the environment they have compromised.
Detects the usage of the 'base64' utility with the decode flag ('-d' or '--decode') on Linux systems. This activity can indicate an adversary attempting to deobfuscate or decode base64-encoded text, which is a common technique for hiding malicious payloads or commands.
Detects the enumeration of other remote systems.
Detects system information discovery commands
Detects usage of the "usermod" binary to add users add users to the root or suoders groups
Detects when the file "passwd" or "shadow" is copied from tmp path
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Detects usage of "find" binary in a suspicious manner to perform discovery
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
Detects execution of shells from a parent process located in a temporary (/tmp) directory
Page 67 of 68