Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects potential data exfiltration of removable media file contents over HTTP. It specifically looks for HTTP POST requests to a URI containing "upload" with a payload size greater than 50,000 bytes. A threshold is applied to prevent excessive alerts, triggering if 5 such events occur from the same source within 60 seconds.
This rule detects the upload of a malicious executable file (identified by the 'MZ' header) to a SharePoint server via the REST API endpoint for folder manipulation. Specifically, it looks for HTTP POST requests to URIs containing '/_api/web/getfolderbyserverrelativeurl' with file data that starts with 'MZ'. This indicates an attempt to upload an executable file, potentially for lateral movement or further compromise within a SharePoint environment.
This rule detects network traffic where an HTTP request is made to 'ssm.amazonaws.com' with the URI containing 'StartSession'. This combination indicates the initiation of an AWS Systems Manager (SSM) Session Manager session, which can be used for legitimate remote administration but also for lateral movement by attackers.
This rule detects a high volume of requests to download repository archives from a GitLab instance. Specifically, it triggers when 10 or more HTTP requests containing '/repository/archive' in the URI and 'gitlab.' in the HTTP host header are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate data by bulk downloading repository contents.
This rule detects potential bulk downloads from SharePoint document libraries. It triggers when a client makes 30 or more HTTP requests to a SharePoint API endpoint related to web lists ('/_api/web/lists') within a 60-second window. This behavior can indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects bulk harvesting of Microsoft Teams messages via the Graph API. It triggers when a client makes 20 or more HTTP requests within 60 seconds to graph.microsoft.com with URIs containing both '/teams/' and '/messages'. This behavior could indicate an attempt to exfiltrate a large volume of communication data from Microsoft Teams.
This rule detects potential data exfiltration of screen window lists via HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the case-insensitive string "windows" and the data size is greater than 200 bytes. This combination suggests an attempt to send information about open windows on a system to a remote server.
This rule detects attempts to enumerate USB and peripheral devices on a Windows system via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'Win32_USBHub' in the URI, indicating a WMI query to list USB devices. This activity is often associated with discovery tactics by attackers who have gained initial access to a system.
This rule detects potential Office 365 email account enumeration attempts via the Microsoft Graph API. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with URIs containing both '/users/' and '/mailboxSettings'. This pattern is indicative of an attacker attempting to discover valid user accounts and their mailbox settings.
This rule detects attempts to enumerate AWS IAM groups via the 'ListGroups' API call. It specifically looks for HTTP traffic directed to 'iam.amazonaws.com' with 'ListGroups' in the URI, indicating a potential reconnaissance activity against AWS Identity and Access Management.
This rule detects when an attacker enumerates Azure AD group memberships via the Microsoft Graph API. It specifically looks for HTTP requests to 'graph.microsoft.com' with URI paths containing '/groups/' and '/members', indicating an attempt to list group members. A threshold is applied to detect a burst of such requests from a single source.
This rule detects HTTP requests to a Docker daemon's API endpoint (port 2375) specifically targeting the '/networks' URI. This indicates an attempt to enumerate Docker network resources, which could be part of a reconnaissance phase by an attacker to understand the containerized environment.
This rule detects HTTP requests to the Google Cloud Asset Inventory API, specifically targeting the '/assets' endpoint. This activity could indicate an attempt to enumerate cloud resources within a Google Cloud Platform environment.
This rule detects attempts to enumerate AWS S3 buckets by making HTTP requests to s3.amazonaws.com with the '?list-type=2' parameter in the URI. This type of request is commonly used to list the contents of an S3 bucket.
This rule detects attempts to enumerate AWS EC2 instances via the DescribeInstances API call. It specifically looks for HTTP traffic destined for 'ec2.amazonaws.com' with 'DescribeInstances' in the URI, indicating a potential reconnaissance activity against AWS EC2 infrastructure.
This rule detects attempts to query the list of installed AntiVirus (AV) and Endpoint Detection and Response (EDR) products via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'AntiVirus' in the URI, indicating an attempt to use Windows Management Instrumentation Command-line (WMIC) to enumerate security software.
This rule detects attempts to query software inventory using 'wmic product' via a web shell. It specifically looks for HTTP requests where the URI contains the string 'wmic product', indicating a potential command execution to enumerate installed software on a compromised system.
This rule detects attempts to enumerate objects within a Google Cloud Storage (GCS) bucket. It triggers when HTTP requests are made to 'storage.googleapis.com' with a URI containing '/b/', indicating an attempt to access or list buckets or their contents. The thresholding mechanism (10 events within 30 seconds from the same source IP) aims to identify rapid, potentially automated, enumeration activities.
This rule detects HTTP POST requests to graph.microsoft.com with the URI containing 'roleAssignmentScheduleRequests'. This pattern is indicative of an Azure PIM (Privileged Identity Management) Just-in-Time role activation request, which is a mechanism for users to temporarily elevate their privileges within Azure AD. While a legitimate administrative action, it can also be used by attackers for privilege escalation.
This rule detects the creation of a new cloud account (user) in Amazon Web Services (AWS) via the Identity and Access Management (IAM) API. It specifically looks for HTTP traffic to 'iam.amazonaws.com' with 'CreateUser' in the URI, indicating an attempt to create a new IAM user.
This rule detects the upload of virtual machine disk images (VMDK, OVA, OVF, QCOW2, VHD) to cloud storage via HTTP PUT requests. The rule specifically looks for HTTP PUT methods, URIs ending with common VM image file extensions, and a minimum file size of 1MB, indicating a substantial file transfer. This activity could signify an attacker attempting to upload a backdoored or malicious VM image for persistence or to establish a foothold in a cloud environment.
Page 146 of 202