Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,265 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,027
2,538
1,075
1,048
927
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
901
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the use of the 'steghide' binary with the 'embed' command and specific flags ('-cf' or '-ef') to hide files using steganography. This technique can be used by adversaries to embed malicious payloads or sensitive data within legitimate-looking files, such as images, to evade detection.
Detects disabling security tools
Detects the creation of shell scripts (files ending with .csh or .sh) within the '/etc/profile.d/' directory. This directory is used to store shell scripts that are executed when a user logs in, making it a common target for adversaries to establish persistence or elevate privileges.
Detects the use of the 'wget' utility to download and create files within common temporary directories like '/tmp' or '/var/tmp' on Linux systems. This activity can be indicative of an adversary performing ingress tool transfer or staging malicious files.
This rule detects the use of the 'grep' command on Linux systems to identify information about the operating system's architecture. Adversaries often combine this activity with other discovery commands like 'uname' or 'cat /proc/cpuinfo' to gather system details. The rule specifically looks for 'grep' executions where the command line arguments include common architecture strings such as 'aarch64', 'arm', 'i386', 'i686', 'mips', or 'x86_64'. This activity is indicative of an attacker attempting to understand the environment they have compromised.
Detects attempts to exploit the VMware Workspace ONE Access Admin Remote Code Execution vulnerability (CVE-2022-31659) by monitoring for POST requests to the '/SAAS/jersey/manager/api/migrate/tenant' URI. This URI is associated with the migration API, and suspicious activity here could indicate an attacker attempting to leverage the vulnerability for remote code execution.
Detects the usage of the 'base64' utility with the decode flag ('-d' or '--decode') on Linux systems. This activity can indicate an adversary attempting to deobfuscate or decode base64-encoded text, which is a common technique for hiding malicious payloads or commands.
Detects potential OGNL Injection exploitation, which may lead to RCE.
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location
Detects the enumeration of other remote systems.
Detects system information discovery commands
Detects usage of the "usermod" binary to add users add users to the root or suoders groups
Detects potential local file read vulnerability in JVM based apps.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
Detects process execution related exceptions in JVM based apps, often relates to RCE
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Detects shellshock expressions in log files
Detects when the file "passwd" or "shadow" is copied from tmp path
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Detects the creation of a new named pipe using the "mkfifo" utility
Detects usage of "find" binary in a suspicious manner to perform discovery
Page 342 of 346