Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,266 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,028
2,539
1,076
1,048
928
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,335
1,318
902
884
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
Detects potentially suspicious child processes spawned by the SSH daemon (sshd) that execute commands using 'bash -c' or 'sh -c' as the root user. This behavior is indicative of potential exploitation of CVE-2024-3094, a backdoor in the XZ Utils library.
Remote File Copy
Sigma
Detects the use of tools that copy files from or to remote systems
This rule detects suspicious usage of the 'curl' command on Linux systems that indicates a file upload or data transfer to a web service. It specifically looks for the 'curl' executable being run with command-line arguments such as '--form', '--upload-file', '--data', or their variations ('--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), or the shorthand options '-F', '-T', '-d'. The rule filters out connections to localhost or 127.0.0.1 to reduce false positives from legitimate local development or testing activities.
This rule detects the execution of common archiving utilities (zip, gzip, tar) on Linux systems. Adversaries often compress data prior to exfiltration to reduce its size and make it easier to transfer. This rule specifically looks for the 'execve' system call with 'zip', 'gzip -k', or 'tar -c' as the primary command and arguments.
Detects the execution of the 'mount' command with the 'hidepid=2' option. This parameter is used to hide processes from other users on the system, which can be leveraged by adversaries for defense evasion by making their malicious processes less visible.
This rule detects network connections initiated by an executable to sub-domains associated with the "LocaltoNet" tunneling service. LocaltoNet is a reverse proxy that exposes localhost services to the internet. Adversaries have been observed leveraging this service for command-and-control (C2) activities, often to bypass multi-factor authentication (MFA) and perimeter security controls.
Alert on Benign Binary contacting a TOR IP
A malicious file contacting a known Tor Exit Node.
IP Target Prevalence
YARA-L
Detect events that are communicating to IP addresses that have a low rolling max prevalence.
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
Detects a suspicious curl process start the adds a file to a web request
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
Detects user account creation on ESXi system via esxcli
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
This analytic detects the insertion of a Linux kernel module using the `insmod` utility. It leverages data from Linux Auditd, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this could lead to unauthorized code execution, persistent access, and severe compromise of the affected system.
The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise.
Page 325 of 346