Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,265 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,027
2,538
1,075
1,048
927
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
901
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. Specifically looks for messages related to dropping source port zero packets, denied AXFR requests, and fatal errors causing an exit.
This rule detects the execution of the 'grep' command on Linux systems when it is used to search for specific filenames associated with the GobRAT malware. The filenames include 'apached', 'frpc', 'sshd.sh', and 'zone.arm'. This activity indicates that an attacker, potentially using GobRAT, is attempting to discover files related to their malware deployment or persistence mechanisms.
Detects the use of `iptables` or `ip6tables` commands to flush all firewall rules, tables, and chains, potentially allowing all network traffic. This action is often performed by adversaries to impair defenses and bypass network restrictions.
This rule detects the execution of a script via the SCX RunAsProvider ExecuteScript function, which is associated with the OMIGOD vulnerability. Specifically, it looks for process creation events where the user is 'root', the LogonId is '0', the CurrentDirectory is '/var/opt/microsoft/scx/tmp', and the CommandLine contains '/etc/opt/microsoft/scx/conf/tmpdir/scx'. This pattern indicates the execution of a temporary script created by the SCX agent, often exploited for privilege escalation or initial access.
Detects the use of 'arp -a' or 'ping' commands targeting common private and loopback IP address ranges on Linux systems, which can indicate an adversary performing remote system discovery.
Detects the use of `grep` or `egrep` commands on Linux systems to search for common security software process names. This activity can indicate an adversary attempting to discover installed security solutions on a compromised host.
Detects when a Java process spawns suspicious child processes, specifically various shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), or common command-line tools like curl, wget, and python. This behavior can indicate a Java application being exploited to execute arbitrary commands on the system.
Detects attempts to exploit an Apache Spark server via CVE-2022-33891, which is a shell command injection vulnerability, by looking for specific patterns in web server query strings.
This rule detects common SQL exception types in Python applications as defined by PEP 249. These exceptions (DataError, IntegrityError, ProgrammingError, OperationalError) indicate issues during database operations, which could range from malformed queries to database connectivity problems or constraint violations. While often benign, repeated or unusual occurrences of these errors could signal application vulnerabilities being exploited (e.g., SQL injection attempts leading to syntax errors) or other malicious database interactions.
This rule detects attempts to remove the immutable file attribute on Linux systems using the 'chattr' command with the '-i' flag. The immutable attribute prevents a file from being modified, deleted, or renamed, even by the root user. Adversaries may remove this attribute to modify critical system files or logs for defense evasion purposes.
This rule detects attempts to gather system and hardware information on Linux systems by monitoring access to specific files and directories that contain details about the BIOS version, product name, chassis vendor, SCSI devices, IDE hard drive models, kernel version, and operating system release information. Adversaries often access these files during the discovery phase to understand the environment they have compromised.
lnx_susp_dev_tcp
Sigma
Detects suspicious command with /dev/tcp
This rule detects outbound network connections from a Linux system to known Monero crypto mining pools. The detection is based on a predefined list of destination hostnames associated with various Monero mining operations. This activity is indicative of resource hijacking, where a system's computational resources are illicitly used for cryptocurrency mining.
This rule detects the usage of the 'chattr' utility with the '-i' flag to remove the immutable file attribute on Linux systems. Removing this attribute can allow adversaries to modify or delete critical system files that were previously protected, often as a defense evasion technique to hinder forensic analysis or remove persistence mechanisms.
Detects the usage of the 'crontab' utility with the '-r' flag to remove the current user's crontab. This activity can be indicative of an adversary attempting to remove scheduled tasks for defense evasion or to eliminate competition, such as in the case of cryptocurrency miners.
Detects attempts to exploit Apache Spark shell command injection vulnerabilities, specifically CVE-2022-33891, by monitoring for suspicious command-line executions involving 'id -Gn' as a child process of a bash shell. This indicates an attacker successfully injecting commands into the Spark environment.
Detects attempts to force stop the Uncomplicated Firewall (ufw) using the 'ufw-init' script with the 'force-stop' argument, or disabling ufw using the 'ufw disable' command. This activity can indicate an adversary attempting to bypass host-based firewall controls to facilitate network communications for C2, lateral movement, or data exfiltration.
Detects the usage of utilities such as 'systemctl', 'service', and 'chkconfig' to stop or disable services on a Linux system. This activity can be indicative of an adversary attempting to impair defenses or disrupt system operations.
Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
This rule detects a specific threading-related error message in Apache HTTP Server error logs. The error message indicates an issue with priority changes for pthreads, specifically an assertion failure related to `__pthread_tpp_change_priority`. This could be indicative of an underlying problem with the Apache server's threading model, potentially caused by misconfigurations, incompatible modules, or resource exhaustion. While the rule itself doesn't directly detect an attack, such errors could be exploited or could be a symptom of a system under stress or compromise.
Detects potential exploitation attempts targeting the Cacti Command Injection vulnerability, CVE-2022-46169. The rule looks for specific patterns in GET requests to '/remote_agent.php' with 'action=polldata' and 'poller_id=' in the query, combined with suspicious command injection payloads like 'base64 -d | /bin/bash', 'whoami', 'powershell', 'cmd', or 'wget'.
Page 341 of 346