Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,420 detections
Filters
Last updated
All Time
Detection languages
530
348
171
163
130
Contributors
458
316
172
104
97
Categories
878
669
225
184
158
Platforms
1,332
232
184
47
31
Products / Services
10,680
9,761
6,694
4,418
3,744
1,420
MITRE Techniques
450
435
338
325
200
CVEs
28
22
10
9
7
Detects the creation of shell scripts under the "profile.d" path.
Detects the usage of the unsafe bpftrace option
Crontab Enumeration
Sigma
Detects usage of crontab to list the tasks of the user
Detects execution of binaries located in potentially suspicious locations via "nohup"
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Detects System Information Discovery commands
Symlink Etc Passwd
Sigma
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"
Detects execution of the bash shell with the interactive flag "-i".
Curl Usage on Linux
Sigma
Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server
Detects the use of grep to discover specific files created by the GobRAT malware
Nohup Execution
Sigma
Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments
Page 68 of 68