Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This rule detects the execution of the 'grep' command on Linux systems when it is used to search for specific filenames associated with the GobRAT malware. The filenames include 'apached', 'frpc', 'sshd.sh', and 'zone.arm'. This activity indicates that an attacker, potentially using GobRAT, is attempting to discover files related to their malware deployment or persistence mechanisms.
Detects the use of 'arp -a' or 'ping' commands targeting common private and loopback IP address ranges on Linux systems, which can indicate an adversary performing remote system discovery.
Detects the use of `grep` or `egrep` commands on Linux systems to search for common security software process names. This activity can indicate an adversary attempting to discover installed security solutions on a compromised host.
This rule detects attempts to access specific registry keys associated with the Windows Local Security Authority (LSA) to calculate the SysKey. SysKey is a critical encryption key used to protect sensitive system information, including password hashes. Adversaries may attempt to extract the SysKey to decrypt credentials or other sensitive data stored in the LSA, often as part of credential dumping activities. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the ObjectType is 'key' and the ObjectName ends with 'lsa\JD', 'lsa\GBG', 'lsa\Skew1', or 'lsa\Data'. These registry paths are known locations where SysKey components are stored.
Detects PowerShell execution that enumerates Active Directory users with the 'DONT_REQ_PREAUTH' flag set (UserAccountControl flag 4194304). This flag indicates that the account does not require Kerberos pre-authentication, making it vulnerable to AS-REP Roasting attacks where an attacker can request a Ticket Granting Ticket (TGT) without providing credentials and then attempt to crack the hash offline.
This rule detects PowerShell scripts that enumerate directories using `Get-ChildItem` and output the results to a file using `Out-File -append`. The detection logic specifically looks for the combination of `foreach`, `Get-ChildItem`, `-Path`, `-ErrorAction SilentlyContinue`, `Out-File`, and `-append` within the PowerShell script block text. This behavior has been associated with MAZE ransomware for directory discovery.
Detects the execution of the 'echo' command with the '%userdomain%' environment variable. This activity can be used by adversaries to enumerate the domain a user is associated with, which is a common discovery technique.
Detects the execution of 'sc.exe' with the 'query' command-line argument to gather information about registered services on a Windows system. This activity can be indicative of discovery efforts by an attacker.
This rule detects attempts to gather system and hardware information on Linux systems by monitoring access to specific files and directories that contain details about the BIOS version, product name, chassis vendor, SCSI devices, IDE hard drive models, kernel version, and operating system release information. Adversaries often access these files during the discovery phase to understand the environment they have compromised.
lnx_susp_dev_tcp
Sigma
Detects suspicious command with /dev/tcp
This rule detects attempts to enumerate source code repositories, specifically Git repositories, by looking for '.git/' in the URL of GET requests. This activity often indicates an attacker attempting to discover exposed source code.
This rule detects suspicious access attempts to the registry key associated with the Azure AD Health monitoring agent. It specifically looks for Event IDs 4656 (handle to an object was requested) or 4663 (an attempt was made to access an object) on the registry key '\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent'. The rule filters out access attempts made by legitimate Azure AD Health monitoring agent processes to reduce false positives. This detection requires specific SACL auditing to be configured on the registry key.
This rule detects the use of the PowerShell cmdlet 'Get-SmbShare', which adversaries may use to discover shared folders and drives on remote systems. This information can be leveraged for data collection or lateral movement within a network.
This rule detects the execution of the `nslookup` command specifically querying for LDAP service records (`_ldap._tcp.dc._msdcs.`). This type of query is often used during the reconnaissance phase by attackers to discover Active Directory domain controllers and their associated services within a network. This activity can indicate an adversary attempting to map out the network infrastructure.
Detects the use of 'nltest.exe' with command-line arguments indicative of reconnaissance activity, specifically targeting domain trust discovery and domain controller enumeration. Adversaries often use 'nltest.exe' to gather information about the network environment, which can aid in lateral movement and privilege escalation within Windows domains.
This rule detects the execution of 'wmic.exe' with the 'Product' keyword in the command line. This specific command is often used by adversaries to enumerate installed software, including security products like firewalls and antivirus, on a Windows system. This activity is typically part of the discovery phase of an attack, where an attacker gathers information about the environment to plan subsequent actions.
Detects activity that could be related to Baby Shark malware, specifically looking for command-line patterns indicative of its execution and discovery techniques. This includes the use of mshta.exe to execute HTA files via PowerShell, querying the registry for Terminal Server Client information, and using PowerShell to upload files.
Detects patterns indicative of the exploitation of the Serv-U CVE-2021-35211 vulnerability, specifically looking for the execution of 'whoami' in conjunction with specific file paths related to the Serv-U client. This activity has been associated with the threat group DEV-0322.
Detects the execution of PowerShell cmdlets 'Get-NetFirewallRule' or 'Show-NetFirewallRule' to enumerate local firewall rules on a host. This activity is often performed by adversaries during the discovery phase to understand network configurations and potential egress/ingress points.
This rule detects the use of the 'grep' command on Linux systems to identify information about the operating system's architecture. Adversaries often combine this activity with other discovery commands like 'uname' or 'cat /proc/cpuinfo' to gather system details. The rule specifically looks for 'grep' executions where the command line arguments include common architecture strings such as 'aarch64', 'arm', 'i386', 'i686', 'mips', or 'x86_64'. This activity is indicative of an attacker attempting to understand the environment they have compromised.
This rule detects the usage of common macOS command-line utilities for file and directory discovery. Specifically, it looks for executions of '/usr/bin/file' with a very long command line (potentially indicating wildcard usage), '/bin/ls' with the recursive flag '-R', and direct executions of '/usr/bin/find' and '/usr/bin/mdfind'. It also includes a generic detection for '/tree' which might be a custom or less common utility for directory listing.
Page 187 of 203