Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
101 detections
Filters
Last updated
All Time
Detection languages
41
37
10
4
3
Contributors
39
20
10
7
5
Categories
68
61
41
20
12
Platforms
88
6
4
3
2
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
66
60
59
24
19
CVEs
5
2
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects attempts to escalate privileges via sudo
This rule looks for adding a passwordless sudo rule for a CI runner account on Linux. Attackers who gain runner access can then become root freely. Remove the rule and audit runner images. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects attempts to manipulate the sudo timestamp cache by looking for repeated 'sudo -n' commands within a short timeframe. The 'sudo -n' command allows sudo to run a command without prompting for a password, which can be abused by an attacker to maintain sudo privileges or bypass re-authentication if they have already compromised a user's session. The thresholding mechanism (10 times in 30 seconds from the same source IP) aims to reduce false positives from legitimate, infrequent uses of 'sudo -n' and focus on potential automated or rapid attempts to interact with sudo without password prompts, possibly to keep the timestamp alive or to quickly execute multiple commands.
This rule detects potential privilege escalation attempts on UniFi OS systems where the 'ucs-update' service account uses 'sudo' to execute sensitive commands like 'dpkg', 'chmod', or 'systemctl'. This behavior is indicative of the vulnerability described in the Bishop Fox research, where an unauthenticated RCE chain can lead to root escalation.
Detects the execution of the 'tee' command via sudo, potentially indicating local privilege escalation. This activity has been observed in VerdantBamboo campaigns exploiting a sudo misconfiguration for the 'egnyteservice' account on Egnyte Storage Sync systems.
Sudo Caching and Elevation Abuse
Gravwell
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
This rule detects the execution of the 'su' command on Linux systems. The 'su' command is used to run commands with a substitute user and group ID, most commonly to switch to the root user. Related to Copy Fail
This rule detects the execution of SUID binaries by a non-root user, immediately followed by the creation of a persistence mechanism such as a systemd service file or a cron job. This correlation aims to identify potential privilege escalation attempts where an attacker uses an SUID binary to gain elevated privileges and then establishes persistence on the system.
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
The following analytic detects the execution of the 'gawk' command with elevated privileges on a Linux system. It leverages EDR telemetry to identify command-line execution data. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute system commands as root.
Linux VNC Install
Sigma
Detects VNC-based lateral movement activities. Looking for the initial install
Detects the creation of new user accounts on Linux systems using the 'useradd' command with parameters that grant root (UID 0 or GID 0) privileges, or prevent home directory creation, which can indicate a backdoor account.
Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
Detects potential exploitation of the PwnKit vulnerability (CVE-2021-4034) by looking for specific keywords in authentication logs. The rule identifies attempts to execute 'pkexec' with suspicious environment variable content and specific user/TTY information, indicative of a local privilege escalation attempt.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root without authentication by specifying a user ID of -1 or 4294967295.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
Detects the execution of the 'sudo' command with the '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
Page 3 of 5