Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.
Detects potential local file read vulnerability in JVM based apps.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
Detects process execution related exceptions in JVM based apps, often relates to RCE
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.
Detection use of the command "split" to split files into parts and possible transfer.
Detects commandline operations on shell history files
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
JAMF MDM Execution
Sigma
Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.
Detects attempts to use screencapture to collect macOS screenshots
Detects usage of "find" binary in a suspicious manner to perform discovery
Identifies the execution traces of the XCSSET malware. XCSSET is a macOS trojan that primarily spreads via Xcode projects and maliciously modifies applications. Infected users are also vulnerable to having their credentials, accounts, and other vital data stolen.
Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence.
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Detects passwords dumps from Keychain
Detects usage of system utilities to discover files and directories
Credentials In Files
Sigma
Detecting attempts to extract passwords with grep and laZagne
Page 173 of 174