Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
164 detections
Filters
Last updated
All Time
Detection languages
71
38
30
8
7
Contributors
59
31
28
14
7
Categories
45
44
33
31
17
Platforms
123
31
21
14
5
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
56
51
48
41
32
CVEs
10
8
7
7
6
IDS Classtypes
3
2
1
1
IDS Protocols
6
This analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Linux Auditd, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
The analytic detects the initiation of traffic mirroring sessions on Cisco network devices. It leverages logs with specific mnemonics and facilities related to traffic mirroring, such as "ETH_SPAN_SESSION_UP" and "PKTCAP_START." This activity is significant because adversaries may use traffic mirroring to exfiltrate data by duplicating and forwarding network traffic to an external destination. If confirmed malicious, this could allow attackers to capture sensitive information, monitor network communications, and potentially compromise the integrity and confidentiality of the network.
This rule detects exploitation indicators for CVE-2023-20198, a privilege escalation vulnerability in Cisco IOS XE Software Web UI. It looks for specific log messages related to Web UI installation operations, system configuration changes, or successful web logins, in conjunction with the use of specific user accounts ('cisco_tac_admin', 'cisco_support', 'cisco_sys_manager') that are not typically created by default or used by Cisco representatives. The combination of these events suggests an attempt to exploit the vulnerability.
This rule detects attempts to disable logging on Cisco devices by looking for specific commands such as 'no logging' or 'no aaa new-model'. Adversaries may disable logging to evade detection and hinder forensic analysis.
This rule detects attempts to shut down a Cisco device or change its boot mode by looking for specific keywords in Cisco AAA logs. The keywords 'shutdown', 'config-register 0x2100', and 'config-register 0x2142' indicate actions that can lead to a denial of service or a change in the device's operational state.
This rule detects commands executed on Cisco network devices related to the export of private keys or the import/management of PKI certificates. Specifically, it looks for the commands 'crypto pki export', 'crypto pki import', and 'crypto pki trustpoint'. These actions can indicate an attempt to exfiltrate sensitive cryptographic material (private keys) or to establish new trusted certificates, which could be used for defense evasion or to facilitate man-in-the-middle attacks.
Detects Border Gateway Protocol (BGP) authentication failures, which can indicate attempts to brute force BGP peer authentication. Such attacks aim to manipulate routing information, potentially leading to traffic redirection or denial of service.
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
This rule detects commands executed on Cisco devices that indicate file deletion or disk formatting activities. It specifically looks for keywords like 'erase', 'delete', and 'format' in Cisco AAA logs, which could signify an attempt to remove files from flash file systems or wipe disk structures. This activity can be part of defense evasion or impact tactics by adversaries.
This rule detects commands commonly used on Cisco network devices to collect configuration data, which may contain sensitive information such as credentials. The commands include 'show running-config' to display the current operational configuration, 'show startup-config' to display the configuration loaded at boot, and 'show archive config' which can show archived configurations. An adversary might use these commands to gather information about the network, discover credentials, or understand the device's security posture.
Detects Label Distribution Protocol (LDP) authentication failures on Cisco devices, which could indicate an adversary attempting to brute force LDP authentication to manipulate MPLS labels. This could be part of an effort to disrupt network traffic or gain unauthorized access.
This rule detects when a monitor, SPAN (Switched Port Analyzer), or RSPAN (Remote Switched Port Analyzer) is configured or modified on a Cisco network device. These configurations are often used for network sniffing or traffic analysis, which can be legitimate for troubleshooting but also abused by adversaries for data exfiltration or reconnaissance.
This rule detects the execution of 'show history', 'show history all', or 'show logging' commands on Cisco devices. These commands can expose sensitive information, including credentials, that have been entered into the device's command-line interface. Adversaries may use these commands to gather credentials or other sensitive configuration details from network devices.
This rule detects various keywords associated with data transfer and staging activities on Cisco devices. These activities could indicate an adversary attempting to move data onto the device for further exfiltration or to move data off the device. The keywords include common protocols and commands like 'tftp', 'rcp', 'puts', 'copy', 'configure replace', and 'archive tar', which are often used for file transfers and configuration management on network devices.
This rule detects attempts to clear logging or archive history on Cisco network devices. Adversaries may clear command history or logging to remove forensic evidence of their activities, which is a common defense evasion technique.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Cisco Collect Data
Sigma
Collect pertinent data from the configuration files
Page 8 of 8