Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
176 detections
Filters
Last updated
All Time
Detection languages
68
33
18
17
13
Contributors
35
33
27
19
11
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
140
40
6
4
2
Products / Services
48
36
29
25
20
MITRE Techniques
119
92
80
77
46
CVEs
2
1
IDS Classtypes
1
IDS Protocols
1
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects the starting of the RemoteRegistry service via command-line utilities such as 'sc.exe' or 'net.exe'. This service is often started by adversaries to facilitate remote access to the Windows Registry for reconnaissance or enumeration of logon sessions.
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects persistence activities initiated by Postgres-related processes or users involving scheduled tasks and system services.
Detects persistence activities initiated by Postgres-related processes or users involving scheduled tasks and system services.
Detects persistence activities initiated by Postgres-related processes or users involving scheduled tasks and system services.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
Detects the enablement of the Remote Desktop Protocol (RDP) by modifying registry keys or service configurations, specifically when triggered by identified remote access tools or common script interpreters (cmd, powershell, etc.) executing from non-standard user-writable paths such as Temp or AppData. This behavior is indicative of lateral movement preparation.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
Page 3 of 9