Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects creation of malicious container services via Docker API for persistence
Detects unauthorized domain controller replication that may indicate DCSync or rogue DC
Detects creation of inbox rules to hide attacker communications from victim
Detects downloads of executable scripts directly from raw GitHub URLs
Detects automated credential spraying and lateral movement attempts using the sshpass utility targeting common Oracle/PeopleSoft usernames. This specific combination of parameters and targeted accounts matches the bash script deployment mechanism utilized by the ShinyHunters extortion gang.
This rule detects attempts to access the ESXi Hypervisor Command Line Interface (CLI) via HTTPS. It specifically looks for HTTP requests to the '/sdk' and 'vim25' URIs on port 443, which are indicative of vSphere API or CLI interactions with an ESXi host.
Monitors for systems communicating with trycloudflare.com infrastructure, which may indicate creation or use of temporary Cloudflare tunnels capable of bypassing traditional remote access controls.
Identifies network connections to specific IP addresses known to be part of the SniperDz phishing and subscription fraud ecosystem. These IPs are hosted on Horizon IQ and are associated with hundreds of suspicious domains.
Detects oversized DNS queries indicative of DNS tunneling for covert communications
Detects enumeration of Group Policy Objects through SYSVOL share access
Detects TCP SYN flood denial of service attacks targeting internal hosts
Detects creation of new domain accounts via LDAP for persistent access
Detects SMB NTLM relay attacks used for credential capture and lateral movement
This rule detects the execution of the 'dd if=/dev/zero' command over an SSH connection. This command is commonly used to wipe disk content by overwriting it with zeros, which can be an indicator of malicious activity aimed at destroying data or hindering forensic analysis. The rule specifically looks for this string within TCP traffic directed to port 22 (SSH).
This rule detects the use of a SOCKS proxy as an external Command and Control (C2) relay. Specifically, it looks for TCP traffic on port 1080 (a common SOCKS proxy port) from the home network to any destination, and checks for the SOCKS version 5 handshake initiation sequence (05 01 00) at the beginning of the payload. This pattern indicates a client attempting to establish a SOCKSv5 connection, which can be used by malware for C2 communication to evade detection and bypass network restrictions.
This rule detects potential RDP session hijacking attempts originating from an internal host. It specifically looks for TCP traffic destined for port 3389 (RDP) on the home network, with a specific content signature "|03 00|" at the beginning of the payload. A threshold of 3 connections within 10 seconds from the same destination is set to reduce false positives.
This rule detects attempts to query the remote system time via Server Message Block (SMB) by looking for the 'NetRemoteTOD' string in network traffic destined for port 445. This activity is often associated with discovery tactics, where an attacker tries to gather information about the target system.
Detects legitimate software deployment tools used for remote execution
Detects download of password wordlists or hash dumps for offline cracking
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
Detects Shellshock bash CGI exploitation attempts
Page 146 of 246