Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects when a third-party cloud application is authorized to access a Google account. It specifically looks for HTTP traffic to 'accounts.google.com' with a URI containing 'oauth2/auth' and 'scope', indicating an OAuth 2.0 authorization request. A threshold is set to trigger an alert if this activity occurs 3 times within 60 seconds from the same source IP address.
This rule detects HTTP requests made to 'whois.domaintools.com', indicating a WHOIS domain lookup activity via a web service. It triggers an alert if five such requests are observed from the same source within 60 seconds. This activity is often associated with reconnaissance.
This rule detects attempts to use search engine filetype dorking techniques to discover sensitive files. It specifically looks for HTTP requests containing the string "filetype:" in the URI, which is a common operator used in search engines to filter results by file extension. This activity is often associated with reconnaissance efforts by attackers to find publicly exposed documents, spreadsheets, or other files that might contain sensitive information.
This rule detects attempts to fingerprint the version of a Drupal Content Management System (CMS) by requesting the 'CHANGELOG.txt' file. This file often contains version information and is a common target for attackers performing reconnaissance to identify potential vulnerabilities.
This rule detects potential Remote Access Trojan (RAT) callbacks occurring after a remote support session. It specifically looks for HTTP GET requests where the URI contains keywords like 'setup', 'install', 'support', or 'remote' (case-insensitive) and the User-Agent header contains 'MSIE'. This combination suggests a possible RAT communicating with its command and control server, masquerading as legitimate remote support or installation traffic.
This rule detects HTTP requests made to 'search.censys.io', indicating a query to the Censys Internet Asset Database. This activity is often associated with reconnaissance efforts, where an attacker or security researcher gathers information about internet-facing assets.
Detects HTTP requests utilizing a specific, highly verbose, and legacy Internet Explorer 8 User-Agent string. This exact hardcoded string is utilized by a fileless .NET loader (originating from a malspam campaign) to download subsequent payload stages from its staging server.
This rule detects exploitation attempts targeting the Spring4Shell vulnerability (CVE-2022-22965). It specifically looks for HTTP requests containing the string "class.module.classLoader" in the URI, which is a known indicator of this RCE exploitation attempt.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the `/etc/passwd` file on a web server. It specifically looks for HTTP requests where the URI contains the string `/etc/passwd`.
Detects attempts to bypass the UniFi OS authentication gateway by exploiting a path traversal vulnerability. The rule looks for requests to the '/api/auth/validate-sso/' endpoint containing URL-encoded path traversal sequences like '..%2f' or '..%2e'. This indicates an attacker is trying to access internal resources or bypass authentication mechanisms.
Detects HTTP/DNS network traffic attempting to download the Bun runtime from the specific GitHub releases path. This behavior is exhibited by the malicious Python loader in the Hades PyPI supply chain attack to stage its execution environment.
This rule detects web directory brute-force attempts by identifying HTTP requests where the User-Agent header contains the string "DirBuster". DirBuster is a well-known tool used for brute-forcing directories and file names on web servers.
This rule detects web directory brute-force attempts by identifying the 'gobuster' string in the HTTP User-Agent header. Gobuster is a common tool used for directory and file enumeration on web servers, often as part of reconnaissance or vulnerability scanning activities. The rule specifically targets HTTP traffic flowing to the server.
Cron Job Injection via Web Shell
Suricata
This rule detects attempts to inject cron job commands via web shell activity. It specifically looks for HTTP requests where the URI contains the case-insensitive string "crontab", indicating an attempt to modify scheduled tasks on a system through a web interface, likely a compromised web shell.
This rule detects potential AWS CLI API command execution by monitoring HTTP traffic for connections to 'amazonaws.com' and the presence of 'Action=' in the URI. It uses a threshold of 30 occurrences within 10 seconds from a single source IP to reduce false positives, indicating a high volume of API calls typical of automated scripts or tools.
This rule detects multiple attempts to pull container image manifests from public Docker registries (registry.hub.docker.com or ghcr.io). A threshold of 10 pulls within 60 seconds from the same source IP is set to identify potentially malicious or excessive activity, possibly indicating an attempt to enumerate or download numerous container images.
This rule detects attempts to deploy a container with host network mode enabled. It specifically looks for HTTP requests to the '/containers/create' endpoint, which is commonly used by container orchestration systems like Docker, and checks for the presence of 'host' within the HTTP client body, indicating the host network mode configuration. This can be a security concern as it allows the container to have direct access to the host's network interfaces, potentially bypassing network segmentation and security controls.
This rule detects attempts to execute commands within a Kubernetes pod using `kubectl exec`. It specifically looks for HTTP requests to port 8080 (often used by Kubernetes API servers or proxies) with URIs containing both '/exec' and 'pods', indicating an interactive command execution session within a pod.
This rule detects an HTTP flood application-layer Distributed Denial of Service (DDoS) attack. It triggers when a single source IP address sends 200 or more HTTP GET requests to a server within a 10-second window. This behavior is indicative of an attempt to overwhelm the application or server with a high volume of legitimate-looking HTTP requests.
This rule detects HTTP POST requests to pastebin.com's API for pasting content, specifically targeting the '/api/api_paste.php' endpoint. It triggers if the size of the data being uploaded is greater than 1000 bytes, indicating a potential data exfiltration attempt to a public text storage site.
This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 10000 bytes. This indicates a significant amount of data being uploaded to Dropbox, which could be a sign of unauthorized data transfer.
Page 150 of 202