Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects attempts to modify login scripts, specifically '.profile', on a remote host via SSH. The detection is based on observing the string ".profile" within TCP traffic destined for port 22 (SSH) on the home network. This activity could indicate an attacker establishing persistence by modifying user login scripts to execute malicious commands upon subsequent logins.
This rule detects attempts to deface a web server's homepage by replacing its content. It specifically looks for HTTP PUT requests targeting a URI containing "index" (case-insensitive), indicating an attempt to modify an index file. The rule also checks the size of the data being sent in the PUT request, looking for a size between 500 and 5000 bytes, which could indicate the insertion of defacement content.
This rule detects attempts to deface web server content by using an HTTP PUT request to modify files with extensions such as .html, .htm, .php, .asp, or .aspx. It specifically looks for HTTP PUT methods targeting these file types on an internal web server.
This rule detects attempts to move executable files (.exe) over SMB (Server Message Block) by looking for the 'MoveFile' string and the '.exe' extension in network traffic on port 445. This activity could indicate malware being relocated on a network share.
Detects the creation or renaming of files to append the .nspire extension, a direct indicator of NightSpire ransomware encryption activity.
This rule detects the creation or modification of files with specific SHA256 hashes known to be associated with adware. It monitors device file events for these hashes and logs instances where they are created or modified.
This rule detects attempts to modify file timestamps over SMB. Specifically, it looks for the 'SetFileTime' operation within SMB traffic on port 445. This activity can be indicative of an adversary attempting to hide their presence or activities by making malicious files appear to have legitimate creation or modification times, a technique known as timestomping.
This rule detects attempts to modify the macOS Transparency, Consent, and Control (TCC) database over an SSH connection. The TCC database stores user privacy settings, and its modification can indicate an attempt to bypass security controls or escalate privileges. The rule specifically looks for the string "TCC.db" within TCP traffic directed to port 22 (SSH).
This rule detects attempts to add an SSH key to a server's authorized_keys file via a web shell. It specifically looks for HTTP POST requests where the URI content includes "authorized_keys". This activity is indicative of an attacker establishing persistence on a compromised server by adding their SSH key for future unauthorized access.
This rule detects network traffic containing the string "/etc/rc" over SSH (port 22) to a server within the home network. This pattern suggests an attempt to modify an RC script for persistence on a Linux system, potentially by an attacker who has gained SSH access.
This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.
This rule detects modifications to macOS Login Hook scripts via SSH. Login Hooks are scripts that execute when a user logs in or out, and their modification can be an indicator of persistence mechanisms used by attackers. The rule specifically looks for TCP traffic on port 22 (SSH) containing the string 'LoginHook' in a case-insensitive manner, indicating an attempt to interact with or modify these scripts.
This rule detects attempts to overwrite critical system binaries (specifically executables in 'system32') via Server Message Block (SMB) protocol. It looks for SMB traffic to port 445, containing 'system32' and '.exe' (case-insensitive), with a payload size greater than 100,000 bytes, indicating a potential file transfer or modification of a large executable.
This rule detects network traffic that indicates a shortcut (.lnk) file is being modified or created in a 'Startup' directory, which is a common technique for establishing autostart persistence on Windows systems. The rule specifically looks for TCP traffic on port 445 (SMB) containing the strings 'Startup' and '.lnk' (case-insensitive).
This rule detects modifications to the 'com.apple.loginwindow' content over a TCP connection to port 22 (SSH). This content is associated with macOS's re-opened applications list, which can be manipulated by adversaries to establish persistence by ensuring malicious applications are launched after a user logs in or a system restarts. The detection specifically looks for the string 'com.apple.loginwindow' in the traffic, indicating an attempt to interact with or modify this critical system component.
This rule detects attempts to modify the shared library configuration file '/etc/ld.so' over an SSH connection. This activity is indicative of a shared library hijacking technique, often used for persistence or privilege escalation, where an attacker modifies the system's library loading paths to inject malicious libraries. The detection specifically looks for the string "/etc/ld.so" within TCP traffic destined for port 22 (SSH) on the home network.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
Detects replacement or hijacking of Terminal Services DLL for persistence
Detects web defacement attempts via HTTP PUT requests to web server content files
Detects the creation or execution of the SSH propagation payload script (.sshu-setup.js), used by the Hades stealer to propagate via SSH from compromised workstations. This rule identifies file creation/modification/renaming events for the specific script name, or process creation events where the command line references the script.
This rule detects potential modification of a network device's system image via TFTP. It specifically looks for UDP traffic on port 69 (TFTP) where the packet size is greater than 50000 bytes and contains the byte sequence "|00 02|" at a depth of 2 bytes, which is indicative of a TFTP write request (opcode 2). The large packet size suggests a system image transfer.
Page 93 of 109