Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects an active remote session hijack attempt. It triggers when three or more TCP connections are established to the same destination within a 10-second window, originating from the internal network and destined for the internal network. This pattern could indicate an attempt to take over an existing network session.
This rule detects attempts to establish a VNC (Virtual Network Computing) connection on TCP port 5901, which is an alternative port often used for VNC. The detection is based on the presence of the 'RFB 00' string, which is part of the VNC protocol handshake, within the initial bytes of an established TCP connection flowing to the server.
This rule detects attempts to disable the Linux Auditd service via a remote SSH connection. It specifically looks for the string "systemctl stop auditd" within TCP traffic destined for port 22 (SSH). Disabling auditd can be an attempt by an attacker to evade detection by removing system auditing capabilities.
This rule detects network traffic indicating the deletion of a persistence registry key, specifically 'CurrentVersion\\Run', after an execution. It looks for TCP traffic to the home network on port 445 (SMB) containing both 'CurrentVersion\\Run' and 'RegDeleteKey' (case-insensitive). This behavior is often associated with malware attempting to clean up its persistence mechanisms to evade detection.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
This rule detects a high number of distinct URLs and total network connections originating from a single remote IP address within a one-minute time window. This behavior can be indicative of various malicious activities such as data exfiltration, command and control (C2) communication, or network scanning. The threshold for distinct URLs is set to greater than 100 and total connections greater than 500.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
Detects non-standard encoding schemes used to obfuscate C2 traffic
Detects scraping of job listings to identify employee roles and technology stack
Detects dynamic domain resolution patterns used for C2 infrastructure rotation
Detects data staged on remote network shares prior to exfiltration
Detects high-volume SQL operations indicative of data manipulation attacks
Detects repeated SSH authentication failures indicating password brute force
Detects bulk email collection via IMAP protocol for mass email harvesting
Detects creation of new local accounts via SMB for persistent access
Detects use of Tor network proxy ports for anonymous C2 communications
Detects generic phishing pages serving credential capture forms to victims
Detects TFTP boot image transfers to network devices for persistent firmware modification
Detects TCP SYN flood denial of service attack patterns
Detects DNS lookups to dynamic DNS providers used for attack infrastructure
Page 148 of 246