Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects a potential Azure AD user account bulk enumeration attempt. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with the URI containing '/users'. This pattern is indicative of an attacker attempting to enumerate multiple user accounts in Azure AD.
This rule detects HTTP requests to 'portal.azure.com', indicating access to the Azure management portal. A threshold is set to trigger an alert if 10 such requests are observed from the same source IP within 60 seconds. This activity is classified as a network scan, potentially for infrastructure discovery.
This rule detects attempts to enumerate the VMware vSphere virtual machine inventory via the API. It specifically looks for HTTP POST requests to the '/sdk/vimService' URI with 'RetrieveProperties' in the client body, indicating a query for system properties, which can include VM inventory details. The detection is focused on network traffic to port 443 (HTTPS) within the home network.
This rule detects HTTP traffic where the URI contains both 'schtasks' and '/delay' (case-insensitive). This combination suggests an attempt to create a scheduled task with a delayed execution, which can be used by adversaries for sandbox evasion or persistence.
This rule detects the potential reuse of an OAuth Bearer token from different IP addresses. It monitors HTTP traffic for the 'Authorization: Bearer' header and triggers an alert if the same token is observed from more than 20 distinct destination IP addresses within a 10-second window. This behavior can indicate an attempt to bypass authentication or session management, potentially through token theft or replay.
This rule detects attempts to purge mailbox data using Exchange Web Services (EWS) by looking for HTTP requests to '/EWS/Exchange.asmx' containing the 'HardDelete' string in the client body. This activity is indicative of an attacker attempting to remove evidence or sensitive information from a compromised mailbox.
This rule detects the creation of a new inbox rule via Exchange Web Services (EWS) that could be used to hide phishing replies. Specifically, it looks for HTTP traffic to '/EWS/Exchange.asmx' with 'NewInboxRule' in the client body, indicating an attempt to create a new inbox rule.
This rule detects HTTP traffic where the host header or URI contains keywords associated with virtual machine software (virtualbox, vmware, qemu) and the URI also contains the word "create". This combination suggests the potential creation or interaction with virtual machines, which could be used for defense evasion by adversaries to hide malicious activity.
This rule detects HTTP traffic where the URI contains both 'certutil' and '-decode' (case-insensitive). This pattern is indicative of an attacker using the Windows built-in 'certutil.exe' utility to decode a file downloaded via HTTP, often as part of a defense evasion or payload extraction technique. The 'flow:to_server,established' indicates that the detection is looking for this pattern in requests going from the internal network to an external server, suggesting a client-initiated download or interaction.
This rule detects HTTP POST requests to cloud compute infrastructure management endpoints, specifically Amazon EC2, Google Cloud Compute, and Azure Management. The rule is triggered if 20 such requests are observed from a single source IP within 60 seconds, indicating potential automated activity to modify cloud infrastructure for evasion purposes.
This rule detects HTTP requests where the URI contains specific system script names like 'pubprn', 'syncappvpublishingserver', or 'winrm'. These scripts are known to be abused by attackers to proxy code execution, often as a defense evasion technique. The rule specifically looks for these patterns in HTTP URIs in traffic flowing to the server.
This rule detects attempts to execute commands indirectly via 'bash.exe' on Windows systems, specifically looking for HTTP requests where the URI contains both 'bash.exe' and the '-c' argument, which is commonly used to pass commands to a shell. This behavior is indicative of an attacker using Bash on Windows (e.g., Windows Subsystem for Linux or Git Bash) to execute arbitrary commands, potentially as part of a defense evasion or command and control tactic.
This rule detects a credential stuffing attack characterized by a high volume of HTTP POST requests to a 'login' URI from a single source IP address within a short timeframe. It specifically looks for HTTP traffic where the method is POST and the URI contains 'login' (case-insensitive). A threshold of 100 such attempts within 60 seconds from the same destination IP address triggers the alert.
This rule detects attempts to read the '/etc/shadow' file via a web shell or similar web-based attack. The rule specifically looks for the string '/etc/shadow' within the HTTP URI, indicating an attempt to access this sensitive file through a web request. This is a common technique used by attackers to exfiltrate credentials after gaining initial access to a web server.
This rule detects attempts to harvest credentials from process memory on Linux systems. It specifically looks for HTTP traffic (flow:to_client,established) containing both the string "/proc/self/mem" and "password" (case-insensitive) within the file data. This combination suggests a tool or script is attempting to read memory for credential extraction, often associated with techniques like credential dumping.
This rule detects attempts to dump NTDS.dit via the Volume Shadow Copy technique over HTTP. It specifically looks for HTTP URIs containing both 'vssadmin' and 'ntds.dit' (case-insensitive). This combination suggests an attacker is trying to exfiltrate the NTDS.dit file, which contains Active Directory database information, using the vssadmin utility to create a shadow copy and then access the file.
This rule detects attempts to steal OAuth access tokens by abusing redirect URIs. It specifically looks for HTTP requests containing both 'access_token=' and 'redirect_uri=' in the URI, which could indicate an attacker trying to capture a legitimate access token by redirecting it to a controlled URI.
This rule detects attempts to gain credential access through web application exploits, specifically looking for HTTP URI requests that contain both 'UNION SELECT' (indicative of SQL injection) and 'password' (suggesting an attempt to extract credential-related information). The detection is case-insensitive.
This rule detects attempts to access secrets stored in Azure Key Vault via its API. It specifically looks for HTTP traffic where the host matches the Azure Key Vault domain pattern '*.vault.azure.net' and the URI contains '/secrets/'. This indicates a potential attempt to retrieve sensitive information.
This rule detects attempts to exfiltrate browser password databases over HTTP. It specifically looks for HTTP POST requests containing the string "Login Data" in the client body, which is a common indicator of browser credential theft.
This rule detects the exfiltration of a password store database over HTTP POST. It specifically looks for HTTP POST requests where the URI or content contains the string "passwords" (case-insensitive) and the data size is greater than 1000 bytes. This combination suggests a large file, potentially a database, containing passwords being sent out of the network.
Page 152 of 202