Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,265 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,027
2,538
1,075
1,048
927
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
901
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation of a new user account on Linux systems. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. The rule specifically looks for 'SYSCALL' events where the executable ends with '/useradd' or 'ADD_USER' record types from auditd logs.
Detects the execution of the 'groupdel' command, which is used to delete a group on Linux systems. This activity can be abused by threat actors to remove evidence of their presence or to disrupt legitimate user access by deleting groups.
Detects the removal of packages on Linux systems using common package managers such as 'yum', 'apt', 'apt-get', 'dpkg', and 'rpm'. This activity could be indicative of an adversary attempting to remove forensic artifacts or security tools.
This rule detects the use of the 'touch' command to modify the timestamps of service files. Adversaries may use this technique to make malicious service files appear legitimate or to evade detection by blending them with existing system files. The detection specifically looks for the 'touch' command being executed with the '-t' flag (to set a specific time) and targeting a file ending with '.service'.
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify successful exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Detects potential container discovery by monitoring for common Linux utilities (awk, cat, grep, head, less, more, nl, tail) being used to read specific files within the '/proc' virtual filesystem. Specifically, it looks for access to '/proc/2/' (which would typically be kthreadd outside a container) or '/proc/cgroup' and '/proc/sched' which can reveal containerized environments due to differences in their content or PID mappings.
Detects attempts to print the contents of common history files (like .bash_history or .zsh_history) using command-line utilities such as `cat`, `head`, `tail`, or `more`. This activity is often performed by adversaries for reconnaissance purposes to gather information about previously executed commands, which may contain sensitive data or reveal system configurations.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
This rule detects the execution of programs from suspicious directories on Linux systems. These directories are commonly used by malware or attackers for staging and executing malicious payloads, including temporary folders, web server directories, and data directories of typically exploited services like PostgreSQL, MySQL, and FTP. The rule specifically looks for SYSCALL events where the executable path starts with one of the predefined suspicious paths.
This rule detects relevant ClamAV messages indicating the presence of various types of malware. It specifically looks for keywords like 'Trojan*FOUND', 'VirTool*FOUND', 'Webshell*FOUND', 'Rootkit*FOUND', and 'Htran*FOUND' in ClamAV logs. These keywords suggest that ClamAV has identified and reported a malicious file or component.
Detects the execution of the 'curl' command on Linux systems. This typically indicates an attempt to download files from a remote location or make web requests to external servers. This activity can be associated with adversaries transferring tools or communicating with command and control infrastructure.
Detects attempts to exploit Java-based web applications by identifying common payload strings often used in vulnerabilities like those affecting Confluence (CVE-2022-26134, CVE-2021-26084) and other Java deserialization or expression language injection flaws. The rule looks for specific patterns in web access logs that indicate the presence of Java code execution attempts, such as references to Java classes, runtime execution commands, and encoded characters often used in exploit payloads.
Detects potential OGNL Injection exploitation attempts in JVM-based applications, which could lead to Remote Code Execution (RCE). This rule specifically looks for error messages indicating OGNL parsing failures, such as 'org.apache.commons.ognl.OgnlException' or 'ExpressionSyntaxException', which are common indicators when an attacker attempts to inject malicious OGNL expressions. This type of vulnerability has been exploited in high-profile cases like Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134).
Detects attempts to exfiltrate data by posting a file using the `wget` utility. This can be particularly dangerous if an adversary leverages misconfigured sudo permissions for `wget` to read sensitive files like `/etc/shadow` and then exfiltrate them.
This rule detects attempts to extract passwords from files on Linux systems using the 'grep' command. It specifically looks for executions of 'grep' in conjunction with the keyword 'password', indicating a potential search for credentials.
This rule detects suspicious command-line executions that attempt to create symbolic links to the `/etc/passwd` file. Attackers might do this to gain unauthorized access to user account information, potentially leading to credential dumping or privilege escalation. The rule specifically looks for `ln -s /etc/passwd` and `ln -s -f /etc/passwd` patterns in command lines.
This rule detects attempts to copy the 'passwd' or 'shadow' files from the '/tmp/' directory using the 'cp' command. This activity is highly suspicious as these files contain sensitive user account information, including password hashes (in the case of 'shadow'), and should not typically be copied to temporary directories. An adversary might do this to exfiltrate credentials for offline cracking or to move them to a location accessible for further exploitation.
Detects the installation of new root certificates on a Linux system. Attackers may install root certificates to bypass security warnings when connecting to adversary-controlled web servers or C2 infrastructure, making their malicious traffic appear legitimate. This rule specifically looks for the execution of common Linux utilities used for managing CA certificates: 'update-ca-certificates' and 'update-ca-trust'.
Detects suspicious command executions on Linux systems, specifically focusing on modifications to file permissions (chmod 777, chmod u+s) and copying of shell binaries (/bin/ksh, /bin/sh). These actions are often associated with malware or hacking activities, such as privilege escalation or establishing persistence.
This rule detects the execution of the 'git clone' command on Linux systems when the command line arguments contain suspicious keywords. These keywords are indicative of activities related to exploits, vulnerabilities, remote code execution (RCE), or proof-of-concept (PoC) code for known vulnerabilities like ProxyShell, Log4Shell, and EternalBlue. The rule aims to identify attempts by adversaries to download malicious or exploit-related code from remote repositories.
This rule detects changes to critical Linux auditd configuration files. Adversaries may modify these files to disable or alter auditing, thereby hindering detection of their malicious activities. Monitoring these files for changes can help identify attempts to evade security monitoring.
Page 336 of 346