Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,265 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,027
2,538
1,075
1,048
927
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
901
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects a suspicious curl process start on linux with set useragent options
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Detects java process spawning suspicious children
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Detects usage of "xterm" as a potential reverse shell tunnel
Detects an issue in apache logs that reports threading related errors
Nginx Core Dump
Sigma
Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Detects potential SQL injection attempts via GET requests in access logs.
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
This rule detects the ChinaZ trojan by identifying specific byte patterns associated with its functionalities. These functionalities include collecting system information, sending system information, parsing C2 commands, and performing DNS flood attacks. The rule contains distinct byte patterns for both 32-bit and 64-bit architectures of the malware.
Detects System Information Discovery commands
Detects relevant ClamAV messages
Detects suspicious session with two users present
Detects suspicious shell commands used in various Equation Group scripts and tools
Detects specific commands commonly used to remove or empty the syslog
Detects suspicious shell commands used in various exploit codes (see references)
Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell
Symlink Etc Passwd
Sigma
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Page 344 of 346