Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
18
9
4
3
2
Contributors
8
5
5
4
3
Categories
12
11
6
4
3
Platforms
25
24
10
2
1
Products / Services
7
6
4
3
3
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
2
IDS Protocols
1
1
Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
Detects trojanized cron binaries that hide malicious cron jobs, with indicators resembling Perfctl
Detects a 'git push --force' event in GitHub audit logs. A force push overwrites the remote repository's history with the local history, which is a potentially destructive action.
This technique was notably used in the supply chain attack against the 'aquasecurity/trivy-action' repository, where attackers force-pushed malicious versions to existing version tags.
This technique was notably used in the supply chain attack against the 'aquasecurity/trivy-action' repository, where attackers force-pushed malicious versions to existing version tags.
Detects the use of the 'setcap' utility with parameters that assign all Linux capabilities to a binary file.
This capability can be abused to create a backdoored binary, for privilege escalation, and bypassing security controls.
This capability can be abused to create a backdoored binary, for privilege escalation, and bypassing security controls.
Detects trojanized cron binaries that hide malicious cron jobs, with indicators resembling Perfctl
This rule detects trojanized Linux binaries, specifically targeting those that resemble Kaiji malware. The combination of these strings suggests a malicious binary with persistence and potential crypto-mining capabilities.
Detects replacement or modification of the eScan CONSCTLX.exe component located in C:\Program Files (x86)\eScan\. Replacing this binary may allow execution of a persistent next-stage payload under the guise of a trusted antivirus process.
Detects Azure Hybrid Connection Manager services querying the Azure service bus service
Rule to detect the Hybrid Connection Manager service installation.
Rule to detect the Hybrid Connection Manager service running on an endpoint.
Yara rule that detects Sshdinjector backdoor.
This rule detects the Hybrid Connection Manager service running on a Windows endpoint. It specifically looks for Event IDs 40300, 40301, or 40302 in conjunction with keywords like 'HybridConnection', 'sb://', 'servicebus.windows.net', or 'HybridConnectionManage'. This service is used to connect on-premises resources to Azure services, and its activity could indicate legitimate cloud integration or potentially malicious use for persistence or data exfiltration.
This rule detects DNS queries made by the Azure Hybrid Connection Manager service to the Azure Service Bus service. This activity is considered suspicious because it could indicate an attempt to establish persistence or exfiltrate data through a compromised Hybrid Connection Manager, leveraging the Service Bus as a communication channel.
This rule detects the installation of the 'HybridConnectionManager' service on a Windows system. This service is part of Azure Hybrid Connection Manager, which allows Azure services to connect to on-premises resources. While legitimate, its installation could also be leveraged by an attacker to establish persistence or facilitate data exfiltration from an compromised environment to Azure resources.
Rule to detect the Hybrid Connection Manager service installation.
Rule to detect the Hybrid Connection Manager service running on an endpoint.
Detects Azure Hybrid Connection Manager services querying the Azure service bus service
Page 2 of 2