Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
50 detections
Filters
Last updated
All Time
Detection languages
27
20
2
1
Contributors
25
8
6
3
3
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
30
15
6
Products / Services
22
19
11
8
6
MITRE Techniques
21
17
13
8
6
CVEs
1
IDS Classtypes
11
5
2
2
IDS Protocols
14
5
1
Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.
This rule detects outbound FTP traffic containing the 'STOR' command, which is used in the FTP protocol to upload files to a remote server. This behavior is a common indicator of unauthorized data exfiltration.
This rule monitors for FTP 'STOR' commands followed by large data transfers (exceeding 64KB) initiated from internal hosts to external destinations. This pattern is often indicative of data exfiltration using the File Transfer Protocol (FTP).
Detects the use of the FTP STOR command to transfer files with sensitive extensions (.docx, .pdf, .xlsx, .zip, .7z) to external networks. This behavior is indicative of potential data exfiltration via an unencrypted alternative protocol.
This rule detects outbound FTP traffic containing the 'STOR' command, which is used in the FTP protocol to upload files to a remote server. This behavior is a common indicator of unauthorized data exfiltration.
Detects multiple FTP login failures ('530 Login incorrect') from a single source IP address within a short time window, indicating a potential brute force or password guessing attempt against an FTP service.
Detects repeated use of the FTP 'STOR' command to transmit data to an external host within a short timeframe. The STOR command is used in the File Transfer Protocol (FTP) to upload a file to the server. An unusual frequency of this command toward external destinations may indicate data exfiltration.
This rule monitors for FTP 'STOR' commands followed by large data transfers (exceeding 64KB) initiated from internal hosts to external destinations. This pattern is often indicative of data exfiltration using the File Transfer Protocol (FTP).
Detects multiple FTP login failures ('530 Login incorrect') from a single source IP address within a short time window, indicating a potential brute force or password guessing attempt against an FTP service.
Detects network connections on port 21 (FTP) where the RemoteUrl contains common FTP data type commands ('TYPE A', 'TYPE I', 'TYPE a', 'TYPE i'). This could indicate active FTP sessions, potentially for data transfer or exfiltration.
Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.
Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.
Detects attempts to exploit the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for keywords related to FTP default configuration exploitation, specifically 'Safe_ports', 'CONNECT', 'PORT', 'PASV', '21', and 'tcp_outgoing_address'. This indicates an adversary trying to bypass security controls or exfiltrate data via FTP.
This rule detects network events where an FTP LIST response contains malformed directory entries, potentially indicating an attempt to exploit the Squidbleed vulnerability. It specifically looks for network signature inspections on port 21 (FTP) with common FTP commands (LIST, NLST, MLSD, MLST, RETR) in the RemoteUrl, while excluding common log and text file extensions.
Detects unusual FTP command sequences where common file listing commands (LIST, NLST, MLSD) are used without specifying a filename parameter, and the RemoteUrl length is unusually short, potentially indicating reconnaissance or an attempt to exploit a vulnerability like Squidbleed. The rule specifically excludes common file extensions to reduce false positives.
Detects unusually fast response times for FTP LIST commands, which could indicate an automated or programmatic interaction with an FTP server, potentially related to a vulnerability exploitation or data exfiltration attempt. The rule specifically looks for network events on port 21 (FTP) where the URL contains 'LIST' and the response time is less than 100 milliseconds.
Detects network events where FTP (port 21) traffic contains specific timestamp-like patterns in the RemoteUrl, which could indicate an attempt to exploit the Squidbleed vulnerability related to timestamp-to-filename parsing anomalies. The rule looks for 'LIST' command combined with '12:34:56', '2026-', or 'timestamp' in the URL.
This rule detects potential exploitation of the Squidbleed vulnerability by identifying network connections to FTP port 21 where the remote URL contains 'PASV' or 'EPSV' commands, and the initiating process is 'squid.exe'. This indicates an attempt to abuse FTP passive mode through the Squid proxy.
Detects attempts to exploit the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for keywords related to FTP default configuration exploitation, specifically 'Safe_ports', 'CONNECT', 'PORT', 'PASV', '21', and 'tcp_outgoing_address'. This indicates an adversary trying to bypass security controls or exfiltrate data via FTP.
Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.
Detects unusually fast response times for FTP LIST commands, which could indicate an automated or programmatic interaction with an FTP server, potentially related to a vulnerability exploitation or data exfiltration attempt. The rule specifically looks for network events on port 21 (FTP) where the URL contains 'LIST' and the response time is less than 100 milliseconds.
Page 2 of 3