Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects attempts to fetch Python package files (setup.py or __init__.py) from pypi.org over HTTP. This activity could indicate a client attempting to download or interact with Python packages, potentially including malicious ones, from the Python Package Index. The rule uses a threshold to alert on frequent occurrences from the same source.
This rule detects attempts to pull a Docker image via an unauthenticated Docker API. Specifically, it looks for HTTP requests to the '/images/create' endpoint on port 2375, which is the default unauthenticated Docker API port. This activity could indicate an attacker exploiting an exposed Docker daemon to deploy malicious images or gain further access to the host system.
This rule detects attempts to spawn a shell inside a container via the Docker API. Specifically, it looks for HTTP traffic directed to port 2375 (commonly used for the Docker API) containing the string "/bin/sh" in the client body, indicating a command to execute a shell.
Detects C2 beaconing and token validation activity via GitHub API commit searches using the exact strings hardcoded in the Miasma payload. The worm uses these searches to validate connectivity and verify stolen token legitimacy.
This rule detects HTTP POST requests where the URI contains both 'wp-content' and 'uploads', indicating potential command and control (C2) communication from a compromised website, likely a WordPress site. The rule specifically looks for requests with a body size greater than 500 bytes, suggesting data exfiltration or command execution.
This rule detects HTTP requests to domains associated with free SSL certificate issuance (Let's Encrypt or ZeroSSL) where the URI contains 'acme'. This could indicate an attacker attempting to obtain a free SSL certificate for a domain they control, potentially for use in phishing or other malicious activities. The rule uses a threshold to prevent excessive alerts from legitimate certificate renewals.
This rule detects the download of common offensive security tools such as Mimikatz, LaZagne, Rubeus, BloodHound, and SharpHound. It specifically looks for these tool names within the HTTP URI during client-to-server HTTP traffic.
This rule detects a high rate of HTTP GET requests that are likely resulting in 404 (Not Found) errors, indicative of a directory brute-force attack. The rule triggers if a single source IP makes 50 or more HTTP GET requests within a 10-second window, suggesting an automated attempt to discover hidden directories or files on a web server.
This rule detects HTTP requests where the User-Agent header contains the string "ffuf" (case-insensitive). FFUF (Ffuf is a Fast Web Fuzzer) is a common tool used for web enumeration, including directory and file brute-forcing. Detection of this User-Agent indicates a potential reconnaissance activity or an attempt to discover hidden web resources.
This rule detects HTTP requests originating from the Nessus vulnerability scanner. It specifically looks for the string "Nessus" (case-insensitive) within the HTTP User-Agent header of outgoing HTTP traffic from the protected network.
This rule detects HTTP connections to known paid intelligence databases. It specifically looks for hostnames containing 'silobreaker.com', 'sixgill.io', or 'cybersixgill' in HTTP traffic flowing from the home network to any destination. This could indicate an internal system or user accessing external threat intelligence platforms, which might be a normal operation for security teams but could also be an indicator of reconnaissance activity by an adversary.
This rule detects a recurring download pattern associated with Microsoft BITS (Background Intelligent Transfer Service). Specifically, it looks for HTTP traffic where the User-Agent header contains "Microsoft BITS" and triggers an alert if 10 such events occur within 3600 seconds from the same source IP address. This pattern can indicate an adversary using BITS for persistent downloads, potentially for malware delivery or command and control.
This rule detects attempts to exfiltrate clipboard data over HTTP using a POST request. It specifically looks for HTTP POST requests where the URI or content contains the string "clipboard" (case-insensitive). This behavior is indicative of malware or malicious scripts trying to steal sensitive information copied by the user.
This rule detects potential data exfiltration to a GitLab repository. It specifically looks for HTTP POST requests to gitlab.com with the URI containing '/git-receive-pack' and a data size greater than 10KB. This pattern is indicative of a 'git push' operation, which could be used to exfiltrate data.
This rule detects potential data exfiltration attempts via a GitHub repository push. It specifically looks for HTTP POST requests to 'github.com' with the URI '/git-receive-pack' and a data size greater than 10000 bytes. This pattern is indicative of a 'git push' operation, which could be used to upload sensitive data to a public or controlled GitHub repository.
This rule detects a potential SMS Pumping Attack, specifically targeting bulk One-Time Password (OTP) requests. It triggers when a single source IP address makes more than 50 HTTP POST requests to a URI containing "send_sms" within a 60-second window. This behavior is indicative of an attacker attempting to exploit SMS delivery systems by repeatedly requesting OTPs, potentially leading to financial costs for the service provider or overwhelming users with messages.
This rule detects multiple HTTP requests to 'iam.amazonaws.com' with the URI containing 'DeleteAccessKey'. This activity, especially when occurring frequently (5 times in 30 seconds from the same source), could indicate an attempt to revoke cloud account access keys, potentially as part of a lockout impact attack.
This rule detects attempts to execute a system reboot command via a web shell. It specifically looks for the case-insensitive string "reboot" within the HTTP URI of established client-to-server HTTP traffic. This activity is indicative of an attacker who has gained control over a web server and is using a web shell to issue system-level commands, potentially to disrupt services or cover tracks.
This rule detects HTTP POST requests that are likely associated with financial transaction hijacking by banking Trojans. It specifically looks for HTTP POST requests where the host header or URI contains keywords related to banking or payment services (bank, paypal, stripe, wise, transferwise) and the URI also contains the word 'transfer'. Additionally, the request body size must be greater than 200 bytes, indicating a substantial data transfer, which is common in financial transactions.
This rule detects HTTP access to domains or hosts associated with bulletproof hosting infrastructure. It specifically looks for hostnames containing '.ru/', '.cn/', 'frantech', 'serverius', or 'combahton'. A threshold of 5 occurrences within 60 seconds from the same source IP triggers the alert.
This rule detects HTTP POST requests with a client body that appears to be RC4 symmetric encrypted C2 beacon traffic. It specifically looks for HTTP traffic flowing to the server, with a client body between 100 and 500 bytes in size, and whose content matches a PCRE regex for base64 encoded strings. The rule is thresholded to trigger if 20 such events occur from the same source IP within 60 seconds, indicating potential beaconing activity.
Page 145 of 202