Search and filter across all detection sources
1,898 rules
ApexOne - Suspicious commandline arguments
'Detects suspicious commandline arguments.'
[LINUX-SECURITY] Suspicious Command (> /dev/null)
[LINUX-SECURITY] Suspicious Command (/proc/<PID>/cmdline)
suspicious_command_execution
Detects suspicious command execution License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.
Attachment: .csproj with suspicious commands
Attached .csproj file contains suspicious commands.
Teleport Suspicious Commands Executed
A user has invoked a suspicious command that could lead to a host compromise
[BASH] gcc execution
[BASH] History hiding
[BASH] make execution
[BASH] Netcat execution
[BASH] nmap execution
[BASH] stunnel execution
[BASH] suidperl access
[BASH] telnet execution
JexBoss Command Sequence
Detects suspicious command sequence that JexBoss
suspicious_command_shutdown
Command-line execution of the 'shutdown' command
[BASH] .bash_history access
[BASH] csh shell execution
[BASH] /dev/tcp access
[BASH] /dev/udp access
[BASH] /etc/passwd access
[BASH] /etc/shadow access
[BASH] histfile=/dev/null