Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,265 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,027
2,538
1,075
1,048
927
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
901
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation of files with a specific naming pattern '/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}.tar.gz' which has been observed to be used by the threat actor UNC4841 for staging and exfiltration of email-related data.
This rule detects the execution of the 'split' command on Linux systems. The 'split' command is used to break a file into smaller pieces, which can be a technique used by adversaries to bypass data transfer size limits during exfiltration or to make files easier to transfer.
Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.
Detects a bash process initiating an outbound network connection to a remote IP address, which is a common indicator of a reverse shell. This rule specifically looks for '/bin/bash' processes making network connections, excluding connections to localhost or unspecified addresses.
This rule detects the execution of the `nohup` command on Linux systems. `nohup` is a utility that allows a command to continue running in the background even after the user logs out or the terminal is closed. Attackers may leverage `nohup` to maintain persistence for malicious processes or to bypass restrictions in certain environments.
Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection in Zimbra Collaboration Suite Email Server, specifically targeting CVE-2022-27925. The rule looks for POST requests to the '/service/extension/backup/mboximport' endpoint with specific query parameters ('account-name', 'ow', 'no-switch', 'append') and then checks for subsequent requests to '/zimbraAdmin/*.jsp' with a 200 status code, indicating potential successful exploitation and web shell access.
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for the execution of 'xclip' with arguments indicating clipboard selection and output. It is highly recommended for server environments due to the frequent legitimate use of clipboard utilities on user workstations.
Detects exploitation attempts targeting CVE-2018-15473 in OpenSSH, specifically looking for a characteristic error message generated during the pre-authentication phase when an attacker attempts to enumerate valid usernames.
This rule detects the execution of common Linux commands used for system information discovery. Specifically, it looks for processes ending with '/uname', '/hostname', '/uptime', '/lspci', '/dmidecode', '/lscpu', and '/lsmod'. These commands are frequently used by adversaries to gather details about the operating system, hardware, and loaded modules on a compromised system.
This rule detects DNS queries for specific domains associated with the WannaCry ransomware killswitch. The presence of these queries indicates a potential WannaCry infection attempting to resolve its killswitch domain. If the domain resolves, the ransomware may cease its encryption activities.
Detects the use of the '--cpu-priority' command-line parameter, which is commonly associated with cryptocurrency miners, particularly XMRig, to prioritize CPU usage for mining operations. This can indicate the presence of coin mining malware on a system.
Detects the stopping of system firewall services (firewalld, iptables, ufw) on Linux systems. Adversaries may disable firewalls to bypass network controls, facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects various commands and file accesses indicative of system information discovery on Linux systems using auditd logs. It looks for access to common system release files like /etc/lsb-release, /etc/redhat-release, and /etc/issue. Additionally, it identifies the execution of commands such as 'uname', 'uptime', 'lsmod', 'hostname', and 'env'. The rule also flags 'grep' commands searching for virtualization indicators ('vbox', 'vm', 'xen', 'virtio', 'hv') and 'kmod list' commands, which are often used to enumerate loaded kernel modules.
This rule detects the execution of the `bpftrace` utility with the `--unsafe` option. The `bpftrace` tool is a high-level tracing language for Linux, and the `--unsafe` option allows it to perform operations that could potentially compromise system stability or security, such as writing to arbitrary memory locations or executing arbitrary code in the kernel. This usage could indicate an attempt to perform advanced system manipulation, potentially for privilege escalation, stealthy execution, or system compromise.
This rule detects command-line parameters and strings commonly associated with cryptocurrency mining software, specifically targeting Monero miners like XMRig. It looks for specific arguments such as CPU priority settings, donation levels, pool addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), algorithm specifications ('--algo=rx/0'), and base64 encoded versions of these strings. It also includes a specific command for loading the 'msr' kernel module, which can be used by miners to optimize performance.
Detects the spawning of suspicious child processes by an Atlassian Confluence server, specifically looking for shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), curl, wget, or python being executed as child processes of the Confluence Java process. This behavior is indicative of successful exploitation of CVE-2022-26134, a critical remote code execution vulnerability in Atlassian Confluence. The rule focuses on the post-exploitation phase where an attacker would execute commands on the compromised server.
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.
Detects potential exploitation attempts of CVE-2023-2283, an authentication bypass vulnerability in libSSH. The exploitation method causes an error message indicating that keys for curve25519 could not be generated. This error message serves as a sign of an exploitation attempt, not necessarily a successful exploitation.
This rule detects the execution of specific binaries identified as being used by the UNC4841 threat group to deploy the SEASPY backdoor. The binaries include 'BarracudaMailService', 'resize2fstab', and 'resize_reisertab'. Detection is based on the image path ending with any of these specific names.
This rule detects the execution of the 'unzip' command where the target file has a common image file extension ('.jpg' or '.png'). This behavior is indicative of an attempt to extract hidden information, specifically a zip archive, from an image file, a technique often used in steganography for defense evasion or data exfiltration.
Detects the execution of PHP CLI with the "-r" flag to run inline PHP code, specifically looking for calls to the "fsockopen" function. This combination is often used by attackers to create sockets for reverse shell connections, potentially in conjunction with functions like "exec" or "fopen". The rule also checks for common Unix shell names in the command line, indicating an attempt to spawn a shell.
Page 338 of 346