Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects unauthorized modifications or creations of files within critical Linux Pluggable Authentication Module (PAM) directories (such as /etc/pam.d/ and /lib/security/). Attackers often target these files to implement backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common package management tools to minimize false positives.
Detects suspicious behavior involving the 'uptime' system utility, including execution from non-standard paths, unexpected outbound network connections, spawning child processes, or replacement of the legitimate /usr/bin/uptime binary. These behaviors are indicative of masquerading or binary hijacking.
This rule monitors Linux authentication logs for anomalies related to Pluggable Authentication Modules (PAM). It identifies potential security risks by detecting file operations (read, write, create) within PAM-related processes, references to world-writable or temporary directories that may be used for staging credentials, and unusual authentication event patterns.
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
This rule detects potential persistence mechanisms on Linux systems by identifying the creation of new systemd service files, modifications to init.d scripts, or the use of systemctl to enable or start services. The rule specifically excludes standard package management activities (apt, yum, dnf, dpkg) and flags if the triggered service operation involves suspicious file paths.
This rule detects unauthorized write, modification, or creation events on critical SSH binary files (sshd, ssh, scp) on Linux systems. It excludes legitimate package management tools (e.g., apt, yum, dpkg, rpm) from triggering alerts to reduce noise from system updates.
This rule monitors for modifications to critical Name Service Switch (NSS) configuration files (/etc/nsswitch.conf) or the creation/loading of NSS shared library files (/lib/libnss_*.so). Adversaries may target these files to manipulate identity management, gain persistence, or escalate privileges by intercepting authentication requests.
Detects suspicious activity involving the uptime utility on Linux systems. This includes execution from non-standard paths, invocation with unexpected command-line arguments, execution with unusual parent processes, or evidence of the uptime binary being overwritten or written to a non-standard location. Such behavior is often indicative of masquerading or attempts to hide malicious activities.
Detects the deployment and execution of GS-Netcat (gsocket), a tool often used for creating persistent reverse shells or backdoors. The rule identifies processes associated with gsocket, instances where the 'uptime' command is masqueraded with suspicious command-line arguments, and unauthorized creation or modification of systemd service files designed for persistence.
Detects potential credential harvesting activities targeting the SSH and PAM authentication stacks. The rule identifies suspicious file operations (creation/modification/read) by authentication-related processes (sshd, login, su, sudo) involving sensitive files like /etc/shadow or non-standard file paths in temporary directories, as well as the spawning of interpreters that write to these suspicious locations.
Detects two suspicious behaviors related to OpenSSH. The first scenario identifies unauthorized modifications, creations, or renames of core OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) that are not initiated by common package managers, which could indicate persistence mechanisms or backdooring. The second scenario monitors ssh/sshd/scp processes creating or modifying files in common temporary or world-writable directories (/tmp, /var/tmp, /dev/shm, etc.), which is often indicative of credential harvesting or data staging.
Detects potential tampering with Pluggable Authentication Modules (PAM) or configuration files on Linux systems. This includes the loading of non-standard shared libraries by authentication-related processes (sshd, sudo, login), modification of core PAM modules (e.g., pam_unix.so) by non-package manager processes, and unauthorized modifications to files within /etc/pam.d/. It also monitors for credential-related activity where authentication processes write data into temporary or hidden directories.
Detects Linux processes running from non-standard directories that exhibit network beaconing behavior, correlated with the concurrent creation or modification of systemd unit files on the same host. This pattern is indicative of a remote access trojan (RAT) or backdoor establishing persistent command-and-control.
Detects the execution of fltMC.exe originating from a temporary folder, which is indicative of potential malicious activity. The rule monitors for suspicious child processes spawned by this binary, outbound network connections, and file system operations (creation, modification, renaming) associated with this execution context.
Detects potential timestomping activity using PowerShell Set-ItemProperty, as well as specific file metadata manipulation and file operations associated with the JFMBackdoor utilizing fltMC.exe.
This rule detects instances of the JFMBackdoor malware performing timestomping operations within the 'C:\Users\public\jfm\' directory. The malicious activity involves the use of fltMC.exe to perform DLL sideloading, followed by modifying file timestamps to evade forensic analysis and timeline reconstruction, specifically observed as part of the Red Lamassu command 0xE subcommand 0x10.
Detects unauthorized modifications to Nginx configuration files by processes other than the Nginx service itself, known package managers, or common configuration management tools. This behavior is indicative of potential malicious activity, such as the injection of proxy directives (e.g., fastcgi_pass, proxy_pass) as observed in the Velvet Ant Operation Highland, used to pivot traffic into protected or air-gapped network segments.
Detects instances where the creation timestamp of a file is reported as being significantly older (more than 30 days) than the actual file creation event time, as recorded by Sysmon Event ID 2. This is a common indicator of timestomping, where attackers modify file creation metadata to evade detection or blend in with legitimate system files.
Detects execution of fltMC.exe from a location other than the standard Windows System32 directory, correlated with recent file creation or modification events in sensitive directories like ProgramData or User Public folders. This behavior is indicative of an attacker attempting to load malicious kernel-mode drivers or perform system-level operations using a renamed or moved system utility.
Detects unauthorized file operations (Creation, Modification, Rename, Deletion) on sensitive browser-related credential files (e.g., Login Data, Cookies, key4.db) by potentially unauthorized or suspicious processes identified by name.
Detects unauthorized file operations (Creation, Modification, Rename, Deletion) on sensitive browser-related credential files (e.g., Login Data, Cookies, key4.db) by potentially unauthorized or suspicious processes identified by name.
Page 70 of 110