Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects potential reverse proxy phishing pages by looking for HTTP URI requests that contain the keywords 'verify', 'account', and 'secure' (case-insensitive). The presence of these keywords in the URI of an HTTP request, particularly when combined, can indicate an attempt to mimic legitimate login or account verification pages, often used in phishing attacks.
This rule detects HTTP traffic where the URI contains common URL shortener domains (bit.ly, tinyurl, t.co, ow.ly, is.gd) and also contains the string "login" (case-insensitive). This combination is often indicative of phishing attempts that use URL shorteners to obscure malicious links, leading users to fake login pages.
This rule detects network connections to known threat intelligence vendor portals. It specifically looks for HTTP traffic where the host header matches one of the specified domains: intel471.com, ke-la.com, recordedfuture.com, or flashpoint.io. This could indicate an analyst or automated system accessing threat intelligence resources.
This rule detects enumeration of organization profiles on Crunchbase.com by monitoring HTTP traffic for connections to 'crunchbase.com' with a high frequency (15 times in 60 seconds) from a single source IP address. This behavior is indicative of a network scan or automated data collection activity.
This rule detects potential reconnaissance activity targeting investor relations pages on a web server. It triggers when a client makes 10 or more HTTP requests containing the word "investor" (case-insensitive) in the URI within a 30-second window. This could indicate an attacker attempting to gather information about a company's financial status, ownership, or other sensitive details often found on investor relations sections of websites.
This rule detects suspicious background downloads initiated via BITS (Background Intelligent Transfer Service) where the HTTP User-Agent contains "Microsoft BITS" and the requested URI ends with common executable or script file extensions (.exe, .dll, .ps1, .bat). This behavior can indicate an adversary using BITS for ingress tool transfer or to download malicious payloads.
This rule detects attempts to exploit Apache Struts OGNL (Object-Graph Navigation Language) injection vulnerabilities. It specifically looks for HTTP requests where the 'Content-Type' header contains the sequence '%{', which is characteristic of OGNL expressions used in injection attacks against Apache Struts.
This rule detects the download of a malicious Office template file (.dotm) over HTTP. The rule specifically looks for HTTP traffic flowing to the client that contains the ".dotm" string in the URI, indicating a potential template injection attack where a malicious template is delivered to a user.
IIS Native Module Upload Attempt
Suricata
This rule detects attempts to upload a DLL file to an 'modules' directory on an IIS web server using an HTTP PUT request. This activity is indicative of an adversary attempting to establish persistence by installing a malicious IIS native module.
HTTP Server Banner Grabbing
Suricata
This rule detects HTTP server banner grabbing activity. Specifically, it triggers when a client sends a 'HEAD' HTTP request to a server on port 80, and this activity occurs at a high frequency (20 times within 30 seconds from the same source IP). Banner grabbing is a reconnaissance technique used to identify the type and version of web servers, which can then be used to find known vulnerabilities.
This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by looking for the specific JNDI injection string "${jndi:" within HTTP URI requests. This pattern is commonly used by attackers to trigger remote code execution in vulnerable Log4j versions.
This rule detects the download of tools or files that contain 'uac' and 'bypass' in their HTTP URI. This is indicative of an attempt to download a User Account Control (UAC) bypass tool, which adversaries might use for privilege escalation on Windows systems.
This rule detects HTTP requests containing 'phpinfo' in the URI, which is commonly used for system information reconnaissance. This activity is associated with MITRE ATT&CK technique T1082 (System Information Discovery).
This rule detects C2 beaconing activity originating from a potentially injected process. It specifically looks for HTTP traffic where the User-Agent header matches a common Windows Mozilla/5.0 pattern, indicating a Windows client, and the data size is between 1 and 199 bytes. A threshold of 20 such events within 60 seconds from the same source IP triggers the alert, suggesting a beaconing behavior.
This rule detects when an AWS IAM role is assumed, which can be a legitimate activity for temporary elevated access within an AWS environment. The detection is based on HTTP traffic to 'sts.amazonaws.com' with 'AssumeRole' in the URI, indicating a request to the AWS Security Token Service to assume an IAM role. This activity is often associated with privilege escalation techniques.
This rule detects attempts to deliver a setuid shell payload via a web shell. It specifically looks for HTTP requests containing both 'chmod' and '+s' (case-insensitive) in the URI, indicating an attempt to modify file permissions to set the setuid bit.
This rule detects the download of a payload that might be used in a User Account Control (UAC) bypass technique. It specifically looks for HTTP traffic where the URI contains keywords like 'uac.bypass', 'elevate', 'privesc', or 'bypassuac' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
This rule detects attempts to add an SSH key to a server's authorized_keys file via a web shell. It specifically looks for HTTP POST requests where the URI content includes "authorized_keys". This activity is indicative of an attacker establishing persistence on a compromised server by adding their SSH key for future unauthorized access.
This rule detects attempts to add email delegate permissions via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' with a URI containing 'mailboxSettings'. This activity could indicate an attacker attempting to gain unauthorized access to a user's mailbox by granting delegate access to another account, which is a common persistence technique.
This rule detects the creation of malicious Outlook rules via Exchange Web Services (EWS). It specifically looks for HTTP traffic to '/EWS/Exchange.asmx' containing the 'CreateRule' string in the client body, indicating an attempt to establish persistence within an Outlook environment.
This rule detects attempts to deploy a Kubernetes CronJob via the Kubernetes API. It specifically looks for HTTP requests targeting the '/apis/batch' and 'cronjobs' URI paths, indicating an interaction with the batch API group for CronJob resources. This could be an indicator of an attacker attempting to establish persistence or execute malicious code within the Kubernetes cluster by scheduling tasks.
Page 154 of 202