Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects wildcard TLS certificates on cheap TLDs commonly used for attack infrastructure
Detects Kerberoasting attack via high-volume Kerberos TGS requests
Detects Bluetooth OBEX protocol data transfers used for physical data exfiltration
Detects HTTP application-layer flood attacks for denial of service impact
Detects users clicking malicious links that result in malware payload downloads
This rule detects the use of a suspicious wildcard certificate in the TLS handshake where the certificate subject contains a wildcard character followed by a domain name with a specific pattern (6 to 12 alphanumeric characters) and a top-level domain (TLD) from a list associated with malicious activities (xyz, top, club, icu). This pattern is often observed in attack infrastructure, particularly for phishing or command and control (C2) servers, to make them appear more legitimate or to facilitate rapid domain generation. The rule specifically looks for '*.domain.tld' where 'domain' is 6-12 chars and 'tld' is one of the specified suspicious TLDs.
Detects SSH connections between internal hosts indicating lateral movement
Detects creation of malicious inbox rules via Exchange Web Services for persistence
Detects GRE encapsulation used to traverse network boundaries and bypass controls
Detects LDAP-based modification of authentication configurations for credential theft
Detects access to underground exploit kit purchase or sales platforms
Detects self-signed TLS certificates on suspicious domains commonly used for C2
Detects LDAP account modifications used to maintain persistent access
This rule detects HTTP POST requests to pastebin.com's API for pasting content, specifically targeting the '/api/api_paste.php' endpoint. It triggers if the size of the data being uploaded is greater than 1000 bytes, indicating a potential data exfiltration attempt to a public text storage site.
This rule detects large data transfers (over 65000 bytes) to a Server Message Block (SMB) share that contains the string "USBSTOR" in its content. This combination suggests data exfiltration to removable media, as "USBSTOR" is often associated with USB storage devices. The rule uses a threshold of 20 such transfers within 60 seconds from the same source IP to trigger an alert, indicating a sustained large data transfer activity.
This rule detects potential data exfiltration over Bluetooth Network Encapsulation Protocol (BNEP) by monitoring UDP traffic on port 3232. It triggers an alert if more than 5 such packets are observed from a single source within a 60-second window, indicating a possible attempt to transfer data out of the network via Bluetooth.
This rule detects attempts to overwrite router firmware via an SSH session. It specifically looks for the string "flash write" within TCP traffic directed to port 22 (SSH) on the home network. This activity is indicative of an attacker attempting to modify the router's operating system, potentially for persistence, backdooring, or other malicious purposes.
This rule detects a direct User Datagram Protocol (UDP) flood Denial of Service (DoS) attack. It triggers an alert if more than 1000 UDP packets are observed targeting a single destination within a 5-second window. This high volume of UDP traffic is indicative of an attempt to overwhelm a target system or network resource, making it unavailable to legitimate users.
This rule detects internal network traffic to port 3128, which is commonly used by Squid proxy servers. The rule is specifically looking for a high volume of such connections (10 connections within 60 seconds from the same source IP) within the home network, suggesting the use of a Squid proxy for internal command and control (C2) routing. The 'flow:to_server,established' indicates that the rule triggers on established connections from a client within the home network to a server within the home network on port 3128.
This rule detects the use of MQTT (Message Queuing Telemetry Transport) over TLS on port 8883, specifically identifying it as a potential encrypted Command and Control (C2) channel. It triggers an alert if there are at least 5 established TCP connections to port 8883 from a single source within a 60-second window, indicating persistent communication often associated with C2 activities.
This rule detects non-HTTPS/non-HTTP traffic attempting to tunnel over TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP, indicating potential covert communication or tunneling activity often associated with malware or command and control.
Page 152 of 246