Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,265 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,027
2,538
1,075
1,048
927
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
901
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"
Detects execution of the bash shell with the interactive flag "-i".
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Detects command line parameters or strings often used by crypto miners
Curl Usage on Linux
Sigma
Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server
DD File Overwrite
Sigma
Detects potential overwriting and deletion of a file using DD.
Detects the use of grep to discover specific files created by the GobRAT malware
Nohup Execution
Sigma
Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments
Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.
Script being executed gets created as a temp file in /tmp folder with a scx* prefix.
Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.
The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Script being executed gets created as a temp file in /tmp folder with a scx* prefix.
Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.
The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.
Detects events with patterns found in commands used for reconnaissance on linux systems
Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.
Detects usage of system utilities to discover system network connections
Detects enumeration of local network configuration
Detects the use of wget to download content to a suspicious directory
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
Detects wannacry killswitch domain dns queries
Detects a segmentation fault error message caused by a crashing apache worker process
JNDIExploit Pattern
Sigma
Detects exploitation attempt using the JNDI-Exploit-Kit
Page 345 of 346