Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects DNS responses with a very low Time-To-Live (TTL) value, which is a characteristic often associated with fast flux techniques used by malware to rapidly change IP addresses. Specifically, it looks for UDP traffic on port 53 (DNS) where the DNS response contains a specific content pattern indicating a low TTL.
This rule detects Fast Flux DNS activity, specifically rapid IP rotation on a single domain. It triggers when a destination IP address associated with a DNS query changes at least 20 times within a 10-second window. This behavior is characteristic of fast fluxing, a technique used by malware to hide command and control servers behind a constantly changing set of IP addresses.
This rule detects direct SSH connections to cloud virtual machines (VMs) via a serial console interface. It specifically looks for HTTP traffic where the host header contains 'compute.googleapis.com' or 'cloudshell.googleapis.com' and the URI contains 'serialPort'. This indicates an attempt to establish an SSH session through the cloud provider's serial console service, which can be used for administrative access or lateral movement within a cloud environment.
This rule detects attempts to copy the running configuration from a network device via SSH. It specifically looks for the string "show running-config" within TCP traffic destined for port 22 (SSH) on the home network. This activity is often associated with reconnaissance or data exfiltration by attackers or malicious insiders.
This rule detects the use of the Sliver C2 Framework based on a specific pattern in the TLS certificate subject. It looks for the common name (CN) 'multiplayer' within the TLS certificate subject, which is a known indicator for Sliver C2 communications.
This rule detects potential ICMP tunnel command and control (C2) activity by identifying ICMP echo requests (type 8) with an unusually large data payload (greater than 100 bytes). It uses a threshold to alert if more than 20 such packets are observed from the same source IP within a 60-second window, indicating sustained communication that might be indicative of data exfiltration or C2.
This rule detects attempts to remotely enumerate Windows Event Logs over SMB. It specifically looks for TCP traffic on port 445 (SMB) where the content includes both "eventlog" and "EvtQuery" (case-insensitive), indicating a query for event log information.
This rule detects internal HTTP file transfers using the PUT method, specifically looking for executable files (identified by the 'MZ' header) being transferred. This behavior is indicative of a possible tool drop within a network, aligning with the MITRE ATT&CK technique T1570 (Lateral Movement - Internal HTTP File Transfer). The rule focuses on traffic within the home network, suggesting an internal adversary or compromised host attempting to move malicious tools.
This rule detects potential internal SSH lateral movement attempts. It triggers an alert when there are 5 or more TCP SYN packets (indicating connection attempts) to port 22 (SSH) within a 60-second window, originating from a host within the home network and targeting another host within the home network. This threshold-based detection aims to identify rapid, repeated SSH connection attempts that could signify an attacker trying to move between internal systems.
This rule detects attempts to perform raw disk access via SSH, specifically looking for the 'dd if=/dev/sd' command within SSH traffic. This activity could indicate an attacker trying to bypass volume-based security controls or exfiltrate data directly from disk partitions.
This rule detects potential Kerberos 'Pass the Ticket' (PtT) attacks, specifically focusing on the reuse of Kerberos Ticket Granting Tickets (TGTs). It triggers when UDP traffic to port 88 (Kerberos) on the home network contains the byte sequence '|6b|' at the beginning of the payload, and this activity occurs 10 times within 5 seconds from the same source IP. The '6b' byte often indicates a Kerberos AP-REQ message, which is used to request access to a service. Repeated AP-REQ messages from the same source could indicate TGT reuse.
This rule detects network traffic where a TLS certificate is presented with an issuer's common name (CN) containing at least 8 alphanumeric characters and a subject organization (O) that includes common company suffixes like 'LLC', 'Ltd', or 'Inc'. This combination, especially with an unusually formatted issuer CN, could indicate an invalid or suspicious code signing certificate used for executables, potentially associated with trojan activity or defense evasion tactics.
This rule detects attempts to disable PowerShell history logging via an SSH connection. It specifically looks for the strings "Set-PSReadlineOption" and "HistorySaveStyle" within TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker trying to cover their tracks by preventing their PowerShell commands from being recorded.
This rule detects attempts to stop the Microsoft Defender Antivirus service (MsMpEng) remotely via the Server Message Block (SMB) protocol on port 445. The detection is triggered by the presence of "StopService" and "MsMpEng" (case-insensitive) within the TCP payload, indicating a potential defense evasion tactic.
This rule detects the creation of hidden files or directories (those prefixed with a dot) over an SSH connection. Specifically, it looks for the 'mkdir .' string within TCP traffic on port 22, indicating an attempt to create a hidden directory. This technique is often used by attackers for defense evasion to conceal malicious files or activities.
This rule detects HTTP responses from a server to a client that contain the phrase "Your computer is infected" (case-insensitive). This is indicative of a fake security alert page, often used in social engineering attacks to trick users into downloading malware or providing credentials. The rule specifically looks for this content within the file data of an established HTTP flow directed to the client.
This rule detects attempts to add an exclusion path to Windows Defender via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS) containing the strings "Exclusions\Paths" and "WindowsDefender" (case-insensitive). This activity could indicate an attacker trying to disable or bypass antivirus protection.
This rule detects a high volume of UDP traffic on port 4500 to the home network, which is commonly used for IPSec NAT Traversal. The rule is specifically looking for an 'evasion' scenario, implying that this traffic pattern might be indicative of an attempt to bypass security controls or blend in with legitimate IPSec traffic. The threshold of 10 connections from the same source within 30 seconds suggests an attempt to identify sustained or repeated activity rather than a single, isolated event.
This rule detects NAT traversal attempts using GRE (Generic Routing Encapsulation) protocol. It specifically looks for IP packets with protocol number 47 (GRE) and triggers an alert if 5 such packets are observed from the same source IP within a 30-second window. This could indicate an attempt to bypass network address translation or firewalls.
This rule detects attempts to downgrade network device firmware via SSH by looking for the string "boot system flash" in TCP traffic directed to port 22 (SSH). This command is commonly used on Cisco IOS devices to specify the system image to boot from, and its presence in an SSH session could indicate an attempt to revert to an older, potentially vulnerable firmware version or to a malicious image.
This rule detects attempts to patch a Cisco IOS router image remotely via SSH. It specifically looks for the string "copy tftp flash" within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential attempt to modify the router's operating system image from a TFTP server.
Page 153 of 246