Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects DNS lookups to Pastebin used for dead drop C2 configuration retrieval
Detects VNC connections used for visual remote desktop lateral movement
Links the execution of the initial setup.mjs payload to network traffic bound for audit.checkmarx.cx. This rule detects the execution of 'setup.mjs' via 'bun' followed by network communication to 'audit.checkmarx.cx' within a 10-minute window, indicating potential supply chain compromise activity.
This rule detects a Link-Local Multicast Name Resolution (LLMNR) poisoning response from a rogue host. It specifically looks for UDP traffic on port 5355 (LLMNR) where the content contains the byte sequence '|80 00|' at a depth of 4 bytes. A threshold is applied to trigger an alert if 5 such responses are observed from the same source IP within 10 seconds, indicating potential malicious activity like credential harvesting.
Detects the campaign-specific REDCAP-TOKEN cookie name in available endpoint or network event metadata. GTIG reported that INFINITERED used this HTTP cookie to receive encrypted commands and return system, database, and configuration information. This query depends on the cookie value being retained in AdditionalFields by the available sensor or integrated telemetry source.
Detects Python executing a proxy tunnel via the '-remote_ip' argument, which is indicative of PySoxy usage for SOCKS proxying. This activity can be used by adversaries for command and control or data exfiltration.
Detects network requests to the HarborWatch API endpoint '/api/agent/tasks/claim'. This activity could indicate an agent attempting to claim tasks from a HarborWatch server, which might be part of legitimate operations or could be indicative of unauthorized access or activity if the agent is not recognized or the request is unexpected.
Detects network requests to the HarborWatch API heartbeat endpoint. This could indicate monitoring or health checks of the HarborWatch system, which might be benign or could be used by an attacker to check for system availability or to maintain persistence.
This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.
Detects scraping of partner and vendor relationship pages for supply chain targeting
Detects download of malware samples from sharing platforms
Detects GRE encapsulation used to bypass network address translation controls
This rule detects multiple access attempts to administrative SMB shares (C$, D$, E$, ADMIN$, IPC$) from a single source IP address within a 5-minute window. This behavior can be indicative of lateral movement, reconnaissance, or ransomware activity attempting to spread across a network by accessing critical shares.
This rule detects the use of self-signed TLS certificates where both the issuer and subject Common Name (CN) match a suspicious pattern. The pattern specifically looks for CNs that are 5 to 20 alphanumeric characters or hyphens, followed by one of several top-level domains (TLDs) commonly associated with malicious activity: .xyz, .top, .club, .icu, or .pw. This combination of self-signed certificates and suspicious TLDs is often indicative of command and control (C2) communication from malware.
This rule detects anomalous network connections originating from common communication applications (Teams, Slack, Discord, Skype) to non-standard ports (not 80, 443, 8080, 8443) and to IP addresses not typically associated with Microsoft or other major cloud providers (e.g., not starting with 13. or 51.). It specifically looks for a high volume of such connections (10 or more within an hour) from a single process on a device, which could indicate protocol tunneling or the use of these applications for command and control.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
This rule detects potential thread hijacking attempts by looking for the presence of specific Windows API calls, 'SuspendThread' and 'SetThreadContext', within HTTP client-to-server traffic. These API calls are commonly used in thread hijacking techniques to manipulate the execution flow of a legitimate process, often to inject and execute malicious code. The rule specifically looks for these strings within file data transmitted over HTTP, suggesting an attempt to deliver a payload that utilizes these functions.
This rule detects the negotiation of an export-grade cipher suite during a TCP connection to port 443 (HTTPS). Specifically, it looks for the byte sequence '|00 1B|' at a depth of 2 bytes within the TCP payload, which corresponds to a specific cipher suite identifier often associated with weaker, export-grade cryptography. This could indicate an attempt to downgrade encryption for easier interception or exploitation.
This rule detects the use of the 'chattr +i' command over a network connection to port 22 (SSH). The 'chattr +i' command on Linux is used to make a file immutable, meaning it cannot be modified, deleted, or renamed, even by the root user. This behavior can be indicative of an attacker attempting to prevent forensic analysis or hinder system recovery by protecting their malicious files or modifying critical system files.
This rule detects attempts to copy the /etc/shadow file, which contains hashed user passwords, for offline password cracking. It specifically looks for the string "cat /etc/shadow" in TCP traffic destined for the home network on any port, indicating a potential exfiltration attempt or preparation for credential access. The rule is designed to alert on established connections where this specific command is observed.
This rule detects attempts to dump LSA secrets by accessing the 'SECURITY\Policy\Secrets' registry key remotely over SMB (port 445). This activity is indicative of credential access attempts, specifically targeting cached credentials or other sensitive information stored in the Local Security Authority (LSA). The rule looks for the specific string 'SECURITY\Policy\Secrets' within TCP traffic destined for port 445, suggesting an attempt to read this registry path.
Page 145 of 246