Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects attempts to abuse an IoT device's firmware update page by sending a large POST request containing the word "firmware" (case-insensitive) to TCP port 80 on the home network. This activity is indicative of an attempt to corrupt the device's firmware, potentially leading to denial of service or unauthorized control.
This rule detects attempts to exfiltrate sensitive data by posting it to common text sharing services. It specifically looks for HTTP POST requests with a body size greater than 1000 bytes directed towards domains associated with services like paste.ee, hastebin, ghostbin, and privatebin.
This rule detects a Slowloris Slow HTTP DoS attack. It triggers when a single source IP sends 100 HTTP GET requests within a 300-second window to the internal network. Slowloris attacks work by holding open many HTTP connections to a web server, eventually exhausting the server's connection pool and making it unavailable to legitimate users.
This rule detects an application layer HTTP POST flood, which is a type of Denial of Service (DoS) attack. It triggers when a single destination receives 200 or more HTTP POST requests within a 10-second window. This high volume of POST requests is indicative of an attempt to exhaust server resources or bandwidth.
This rule detects a denial-of-service attack characterized by a high volume of HTTP GET requests targeting a server within a short timeframe. Specifically, it triggers if a single destination IP address receives 500 or more HTTP GET requests within a 10-second window, indicating a potential HTTP request flood aimed at exhausting service resources.
This rule detects potential C2 beaconing activity over HTTP. It specifically looks for HTTP GET requests where the URI path consists of 8 to 16 lowercase alphanumeric characters. The rule uses a threshold of 20 such requests within 60 seconds from the same source IP address to identify beaconing behavior.
This rule detects attempts to replace cryptocurrency wallet addresses within HTTP POST requests. It specifically looks for patterns matching Bitcoin (P2PKH, P2SH, Bech32) and Ethereum (0x) wallet addresses in the client body of HTTP POST requests. This activity is indicative of clipboard hijacking or similar malware that aims to redirect cryptocurrency transactions to an attacker's wallet.
This rule detects HTTP POST requests from the home network to any destination that contain a large amount of junk data padding in the client body. Specifically, it looks for a client body size greater than 1000 bytes and a PCRE match for at least 500 alphanumeric characters, indicating potential command and control (C2) communication using data padding for obfuscation or to bypass detection. A threshold is set to trigger an alert if 10 such requests are observed from the same source within 60 seconds.
This rule detects potential callback activity from a remote hardware implant. It specifically looks for HTTP requests where the URI contains common callback patterns like '/callback', '/checkin', '/ping', or '/heartbeat', and the User-Agent header indicates a scripting tool such as 'python', 'curl', or 'wget'. The rule also specifies that the HTTP body size should be between 1 and 199 bytes, and it uses a threshold to trigger an alert if 10 such events occur within 60 seconds from the same source.
This rule detects a high volume of HTTP requests to the Confluence REST API endpoint '/rest/api/content'. This pattern of access could indicate an attempt to bulk download content from Confluence spaces, potentially for data exfiltration or reconnaissance purposes. The threshold is set to trigger if 30 such requests are observed from a single source IP within a 60-second window.
This rule detects a high volume of HTTP requests to a Confluence Wiki instance that include both '/wiki/' and 'export' in the URI. Specifically, it triggers if 10 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to bulk export pages from a Confluence Wiki, potentially for data exfiltration.
This rule detects bulk data access from an internal information repository. It triggers when a single source IP address performs 50 or more HTTP GET requests within a 30-second window to any destination. This behavior could indicate an attempt to exfiltrate or rapidly collect large amounts of data from internal web-based resources.
This rule detects attempts to create or modify email forwarding rules in Office 365 via the Microsoft Graph API. Specifically, it looks for HTTP POST requests to the '/mailFolders/inbox/messageRules' endpoint on 'graph.microsoft.com'. This activity can indicate an attacker setting up an inbox rule to forward emails to an external address for data exfiltration or to maintain persistence.
This rule detects potential email harvesting attempts via Exchange Web Services (EWS). It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing 'FindItem' in the client body, indicating an attempt to enumerate or search for items (like emails) within mailboxes. A threshold is applied to prevent excessive alerts from legitimate, but frequent, EWS activity.
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects HTTP POST requests that contain data resembling a ZIP archive (indicated by 'PK' header) and have a size greater than 50,000 bytes. This pattern is often associated with data exfiltration where collected data is archived before being sent out of the network.
This rule detects a high volume of HTTP GET requests to Azure Blob Storage, specifically targeting '.blob.core.windows.net' domains. A threshold of 50 requests within 60 seconds from a single source IP address triggers the alert, indicating a potential bulk data download activity. This could be indicative of data exfiltration or unauthorized access to cloud storage.
This rule detects a high volume of HTTP GET requests to AWS S3 buckets from a single source IP address within a short timeframe. Specifically, it triggers if more than 50 GET requests are observed within 60 seconds to hosts matching 's3.amazonaws.com' or '.s3.' patterns. This behavior can indicate an attempt to exfiltrate data or perform bulk collection from an S3 bucket.
This rule detects attempts to query the Windows Registry via a web shell for system reconnaissance purposes. It specifically looks for HTTP requests containing the string "reg query" in the URI, indicating a command execution attempt to gather system information.
This rule detects attempts to enumerate email accounts using Exchange Web Services (EWS). It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' URI containing the 'FindItem' content in the client body. A threshold of 10 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or discovery activity targeting email accounts.
This rule detects attempts to enumerate local administrator groups via a web shell. It specifically looks for HTTP requests containing the string "net localgroup" in the URI, which is a common command used to list local groups on a Windows system. The detection is case-insensitive and targets established HTTP connections from any source to the home network.
Page 156 of 202