Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects potential abuse of a Certificate Enrollment Web Service (typically Microsoft's CertEnroll) for forgery attempts. It specifically looks for HTTP requests to the '/certenroll/' URI on port 80 (HTTP) within the home network. A threshold of 10 such requests from a single source IP within 60 seconds is set to trigger the alert, indicating a possible automated or rapid attempt to interact with the certificate enrollment service.
This rule detects network traffic to a specific URI path associated with Active Directory Certificate Services (AD CS) enrollment. The URI '/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP' is known to be used in Certificate Enrollment Policy (CEP) web services, which can be abused in ESC1 (ESC1 Certificate Template Privilege Escalation) attacks to obtain certificates with elevated privileges. The rule specifically looks for TCP traffic on port 443 (HTTPS) to this URI, indicating an attempt to interact with the CEP service.
This rule detects automated multi-factor authentication (MFA) push bombing attempts targeting Duo Security's API. It specifically looks for HTTP POST requests to 'api.duosecurity.com' and triggers an alert if 10 such requests are observed from the same source IP within a 30-second window. This behavior is indicative of an attacker repeatedly sending MFA push notifications to a user's device in an attempt to overwhelm them or trick them into approving a fraudulent login.
This rule detects a potential MFA fatigue attack by monitoring repeated HTTP requests to known MFA provider domains (duo.com, okta.com, microsoft.com) containing the string "auth" in the URI. A threshold of 20 requests within 60 seconds from the same destination IP address triggers the alert, indicating an attacker might be repeatedly sending push notifications to a user's device to overwhelm them into accepting an authentication request.
This rule detects network traffic indicative of an 'Evil Twin' access point credential capture portal. It specifically looks for HTTP POST requests where the URI contains both 'wifi' and 'password' (case-insensitive). This pattern suggests a malicious portal designed to trick users into entering their Wi-Fi credentials.
This rule detects network traffic indicative of AnyDesk remote desktop software being used as a command and control (C2) channel. It specifically looks for HTTP requests to 'anydesk.com' or 'relay.anydesk.com' domains. A threshold of 5 connections within 60 seconds from the same source IP is set to reduce false positives.
This rule detects potential command and control (C2) channel activity by identifying HTTP requests where the URI contains specific keywords commonly associated with C2 infrastructure switching or staging. The keywords include 'stage2', 's2', 'next', 'pivot', and 'relay'. This indicates an attacker might be moving to a new phase of their operation or redirecting C2 communications.
This rule detects potential bidirectional command and control (C2) activity leveraging Discord webhooks. It specifically looks for HTTP POST requests to 'discord.com' with the URI containing '/api/webhooks/'. A threshold of 5 such requests within 60 seconds from the same source IP is set to reduce false positives and indicate sustained communication, characteristic of C2.
Hades Decoy Anthropic Traffic
Cortex XDR
Detects suspicious network connections to the Anthropic API endpoint (api.anthropic.com/v1/api) used as exfiltration camouflage by the Hades campaign. The rule specifically looks for traffic to 'api.anthropic.com' with the path '/v1/api', which is documented as returning 404s, indicating potential misuse for covert communication or data exfiltration.
This rule detects access to websites or services that are commonly associated with botnet rental, stresser, or DDoS-for-hire services. It specifically looks for HTTP requests where the host header contains keywords like 'booter', 'stresser', or 'ddoser' (case-insensitive). This indicates a potential policy violation where an internal user might be attempting to utilize or research such services.
This rule detects HTTP requests where the 'Host' header matches patterns commonly associated with serverless function domains, specifically AWS Lambda URLs, Azure Websites, and Google Cloud Functions. The rule is designed to identify potential command and control (C2) infrastructure utilizing serverless platforms. It triggers an alert if 10 such requests are observed from a single source IP within a 60-second window.
This rule detects HTTP traffic where the 'Host' header contains 'workers.dev'. This domain is associated with Cloudflare Workers, which can be used by attackers to deploy attack infrastructure such as command and control (C2) servers, phishing pages, or data exfiltration points. The rule is configured to trigger a threshold alert if 10 such connections are observed from a single source IP within 60 seconds, indicating potential automated activity or repeated attempts to access or deploy malicious worker scripts.
This rule detects network traffic indicative of a compromised host attempting to beacon to a botnet command and control server. Specifically, it looks for HTTP requests where the URI path contains "/gate.php". This pattern is commonly associated with botnet communication.
This rule detects attempts to create or access disposable email accounts by monitoring HTTP traffic for specific keywords in the HTTP host header. It triggers an alert if it observes 5 instances of these keywords from the same source IP within a 60-second window. The keywords include common disposable email service domains like 'guerrillamail', 'tempmail', 'mailinator', and '10minutemail'.
This rule detects HTTP network connections to common Cloud Virtual Private Server (VPS) providers (DigitalOcean, Vultr, Linode, Hetzner) where the URI content includes the word 'create'. This combination suggests an attempt to set up new infrastructure, potentially for malicious purposes, aligning with resource development tactics.
This rule detects potential email directory enumeration attempts by monitoring HTTP requests. It triggers when a client sends 10 or more HTTP requests within 30 seconds to the server, where each request URI contains both an '@' symbol and '.com'. This pattern is indicative of an attacker trying to guess valid email addresses on a domain.
This rule detects a rapid succession of HTTP POST requests to a URI containing 'login' from the same source IP address, indicating a potential credential stuffing or brute-force attack. It triggers an alert if 20 such attempts occur within a 30-second window.
Exposed Git Repository Discovery
Suricata
This rule detects attempts to discover exposed Git repositories on a web server. It triggers when an HTTP request URI contains the string "/.git/", indicating a client is probing for the presence of a Git repository's internal structure. This is a common reconnaissance technique used by attackers to find sensitive information or source code.
WHOIS Database API Bulk Query
Suricata
This rule detects HTTP requests to known WHOIS database API services (whoisxmlapi.com, whoisfreaks.com, whoapi.com). Such activity could indicate an attempt to perform bulk reconnaissance on domains or IP addresses, potentially for malicious purposes like phishing, infrastructure mapping, or identifying targets.
This rule detects the presence of the Acunetix Web Vulnerability Scanner based on its unique User-Agent string in HTTP traffic. It specifically looks for the case-insensitive string "acunetix" within the HTTP User-Agent header in traffic flowing from the internal network to an external server.
This rule detects the download of remote support tools such as AnyDesk, TeamViewer, Atera, Splashtop, and ConnectWise. The detection is based on HTTP URI patterns that match these tool names. This activity is often associated with phone scams where attackers trick users into installing remote access software, giving the attackers control over their systems.
Page 153 of 202