Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects SNMP enumeration using default community strings
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects command-line utilities connecting to notorious cloud storage providers heavily favored by threat actors for data exfiltration.
This rule detects network connections initiated by scripting engines (wscript.exe, cscript.exe) or PowerShell (powershell.exe) to common Remote Desktop Protocol (RDP) ports (3389, 3390, 3391). This activity can be indicative of an adversary attempting to establish or pivot RDP sessions using unexpected processes, potentially for lateral movement or persistence.
Detects network connections on port 21 (FTP) where the RemoteUrl contains common FTP data type commands ('TYPE A', 'TYPE I', 'TYPE a', 'TYPE i'). This could indicate active FTP sessions, potentially for data transfer or exfiltration.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to adversary-controlled cloud buckets.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Identifies the creation of named pipes matching standard Cobalt Strike malleable C2 profiles (\pipe\msagent, \pipe\postex, \pipe\status, \pipe\spoolss) that are associated with network activity, indicating advanced C2 deployment.
Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including aggregator/C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems or active exploitation attempts related to FortiBleed.
This rule detects the execution of known SMB exploitation tools (e.g., Python-based SMBGhost scanners/payloads, Metasploit resource scripts for EternalBlue) and identifies high-fan-out SMB scanning activity or unauthorized SMB connections from non-standard processes to an internal subnet (10.39.x.x).
Detects unusually large FTP responses containing 'LIST' or 'NLST' commands, potentially indicating an attempt to exploit the Squidbleed vulnerability or similar data exfiltration over FTP. The rule specifically looks for network events on port 21 (FTP) where the action type is 'NetworkSignatureInspected' and the RemoteUrl contains either 'LIST' or 'NLST' with a string length greater than 4000 characters.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
This rule detects the execution of a Windows command shell (cmd.exe) spawned by Windows Explorer occurring within a 10-second window of network traffic identified as socket.io or websocket communication. This behavior often suggests a potential reverse shell or C2 connection where a command shell is invoked through or in conjunction with web-based communication channels.
Detects unauthenticated network connections to the Peyara Remote Mouse service on TCP port 1313. This service is known to allow remote control of the host, and such unauthenticated Socket.IO connections are often leveraged by attackers to inject synthetic keyboard events, such as triggering the Windows Start menu.
Detects successful or failed logon attempts originating from IP addresses identified as associated with botnets, C2 infrastructure, or proxies by threat intelligence feeds. This indicates potential malicious activity or compromised accounts.
This rule detects outbound network connections to common tunneling and proxy services (Cloudflare Tunnel, Cloudflare Workers, and Microsoft Dev Tunnels). These services are frequently abused by threat actors, such as the Gamaredon Group (ACTINIUM), to establish command-and-control (C2) channels and tunnel traffic to evade network-based detection systems.
This rule detects network events where an FTP LIST response contains malformed directory entries, potentially indicating an attempt to exploit the Squidbleed vulnerability. It specifically looks for network signature inspections on port 21 (FTP) with common FTP commands (LIST, NLST, MLSD, MLST, RETR) in the RemoteUrl, while excluding common log and text file extensions.
Detects unusual FTP command sequences where common file listing commands (LIST, NLST, MLSD) are used without specifying a filename parameter, and the RemoteUrl length is unusually short, potentially indicating reconnaissance or an attempt to exploit a vulnerability like Squidbleed. The rule specifically excludes common file extensions to reduce false positives.
Page 110 of 246