Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects network connections or web proxy requests to malicious domains (such as colafunfacts.net) known to host initial droppers, decoy pages, and payload archives for the ClickFix RAT campaigns.
Detects automated scraping of staff and employee directory pages
Detects sustained high-rate web access used to determine business operating hours
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule identifies web traffic containing the custom User-Agent string 'HarborWatchAgent', which is indicative of Command and Control (C2) communication by the HarborWatch Agent. It searches both endpoint network events and network appliance/proxy logs for this specific User-Agent string.
This rule detects the creation of a new Azure AD user account via the Microsoft Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing '/users'. This activity could indicate an attacker establishing persistence by creating new accounts in a compromised Azure AD environment.
This rule detects attempts to register a new device for MFA bypass persistence by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'authentication/methods'. This activity could indicate an attacker attempting to register their own device as a trusted device to bypass multi-factor authentication in an Office 365 environment.
This rule detects the download of Visual Studio Code (VS Code) or other Integrated Development Environment (IDE) extensions from official marketplaces (marketplace.visualstudio.com or open-vsx.org) when the downloaded file has a .vsix or .crx extension. This could indicate an attempt to install a malicious extension.
Botnet C2 Panel Access Detected
Suricata
This rule detects potential access to a botnet command and control (C2) panel. It triggers when HTTP URI requests contain both 'panel' and 'bot' (case-insensitive) within the URI. A threshold of 5 such requests from the same source within 60 seconds is set to reduce false positives.
This rule detects HTTP traffic where the referer header contains domains commonly associated with advertising networks (doubleclick.net, adnxs.com, googlesyndication) and the URI contains file extensions typically used for executable or script files (exe, ps1, msi, hta, vbs). This combination suggests a malvertising redirect attempt leading to the download of malicious files.
This rule detects HTTP traffic where the host header contains a domain with at least 8 alphanumeric characters followed by a common top-level domain (.com, .net, .org), and the URI contains the string 'gate' (case-insensitive). This pattern is indicative of a hijacked legitimate domain being used for Command and Control (C2) communication.
This rule detects bulk email account creation attempts on free email providers ProtonMail and Tutanota. It triggers when a client makes 3 or more HTTP requests within 60 seconds to the signup page of either protonmail.com or tutanota.com.
This rule detects attempts to create a new container service via the Docker API. It specifically looks for HTTP POST requests to the '/services/create' URI on port 2375, which is the default unencrypted Docker API port. This activity could indicate an attacker attempting to establish persistence or execute malicious containers on a compromised Docker host.
This rule detects the delivery of a macOS Launch Daemon Property List (.plist) file via HTTP. Attackers often use Launch Daemons for persistence on macOS systems. The rule specifically looks for HTTP traffic containing '.plist' in the URI and 'LaunchDaemon' within the file data, indicating a potential attempt to establish persistence.
Dual-Use Hacking Tool Download
Suricata
This rule detects the download of dual-use hacking tools by inspecting HTTP URI paths for keywords like 'nmap', 'metasploit', 'cobaltstrike', 'empire', 'covenant', and 'sliver'. It specifically looks for these keywords in a case-insensitive manner within the HTTP URI, indicating a potential attempt to download tools that can be used for both legitimate security testing and malicious activities.
This rule detects network connections to known vulnerability intelligence purchase platforms (zerodium.com, crowdfense.com, exodus.gl). These platforms are often used by threat actors to acquire zero-day exploits or other vulnerabilities. Accessing these sites could indicate an organization or individual is attempting to purchase or sell such intelligence, which can be a precursor to malicious activity or a violation of organizational policy.
This rule detects attempts to upload files containing the 'MZ' magic bytes (indicating a Windows executable) to known file-sharing services such as transfer.sh, mega.nz, mediafire, or anonfiles. It specifically looks for HTTP POST requests with file data.
This rule detects the download of executable installer files (MSI or EXE) over HTTP that are larger than 500KB and contain the 'MZ' header, which is characteristic of Windows executables. The rule specifically looks for these files being delivered to a client within the home network. The message indicates a potential 'Executable Installer with Weak File Permission Exploit', suggesting that the downloaded file might be malicious or used in an exploit chain related to weak file permissions.
This rule detects attempts to modify hybrid identity federation settings by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'federationConfiguration'. This activity could indicate an attacker attempting to establish persistence or gain unauthorized access by manipulating identity federation.
This rule detects attempts to upload web shell files to a server's application directory. It specifically looks for HTTP POST requests where the URI contains common web shell file extensions (php, asp, aspx, jsp, cfm) and the file data contains the string "eval(" (case-insensitive), which is a common function used in web shells for code execution.
This rule detects attempts to upload malicious web server modules, plugins, or components. It specifically looks for HTTP PUT requests to URIs containing '/modules/', '/plugins/', or '/components/' and checks the file data for the 'MZ' header, indicating an executable file (likely a Windows executable or DLL). This combination suggests an attacker is trying to upload a malicious executable to a web server's module/plugin directory for persistence or further compromise.
Page 149 of 202