Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects attempts to perform SID History Injection via DCSync Replication. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "DsAddSidHistory" case-insensitively. This activity is indicative of an attacker attempting to add a Security Identifier (SID) from another account to a target account's SIDHistory attribute, often as part of a privilege escalation technique like DCSync attacks, to gain unauthorized access or maintain persistence within an Active Directory environment.
This rule detects attempts to enable the 'xp_cmdshell' stored procedure in Microsoft SQL Server. The rule specifically looks for network traffic on port 1433 (default SQL Server port) containing the keywords 'sp_configure', 'xp_cmdshell', and '1' (indicating enablement). Enabling xp_cmdshell allows SQL Server to execute operating system commands, which is a common technique used by attackers for remote execution and persistence.
This rule detects network traffic over SMB (port 445) containing the string "SCRNSAVE.EXE" in a case-insensitive manner. This is indicative of a potential persistence mechanism where the screensaver executable has been replaced with a malicious one, and its name is being transmitted over the network, possibly during file transfer or command and control activities. The rule specifically looks for traffic flowing to the server on an established connection.
This rule detects attempts to modify the SSH daemon configuration file (sshd_config) remotely over an established TCP connection to port 22. The detection is based on the presence of the string "sshd_config" within the network flow, indicating potential remote manipulation of SSH authentication settings.
Detects requests for a specific favicon image (`/img/ib99-hq.ico`) that is consistently used across all deployments of a threat actor's Next.js gambling kit. This kit is associated with the "Borrowed Trust" campaign. The rule identifies these requests in both endpoint network telemetry and perimeter proxy/firewall logs, indicating potential reconnaissance or active exploitation attempts targeting systems hosting this gambling kit.
This rule detects a high volume of activity (10 or more events within an hour) to Windows administrative shares (C$, IPC$, ADMIN$) from a single source IP address. This behavior can indicate lateral movement, data exfiltration, or other malicious activity using legitimate administrative functions.
This rule detects a high volume of activity (10 or more events within an hour) to Windows administrative shares (C$, IPC$, ADMIN$) from a single source IP address. This behavior can indicate lateral movement, data exfiltration, or other malicious activity using legitimate administrative functions.
This rule detects attempts to execute AppleScript commands remotely over SSH. It specifically looks for the string "osascript" (case-insensitive) within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential remote execution of AppleScript.
This rule detects network traffic on TCP port 830, which is commonly used for NETCONF (Network Configuration Protocol) sessions. The rule specifically looks for the string "<rpc" within the traffic, indicating an RPC (Remote Procedure Call) request, which is a fundamental part of NETCONF communication. This suggests an attempt to establish a CLI (Command Line Interface) session with a network device using NETCONF.
This rule detects attempts to pull a Docker image via an unauthenticated Docker API. Specifically, it looks for HTTP requests to the '/images/create' endpoint on port 2375, which is the default unauthenticated Docker API port. This activity could indicate an attacker exploiting an exposed Docker daemon to deploy malicious images or gain further access to the host system.
Detects kubectl exec and port-forward operations via the Kubernetes API server. 'Exec' provides interactive shell access to a running container, while 'Port-forward' tunnels into the pod network, potentially bypassing network policies. This rule also detects 'attach' operations.
Detects fast flux DNS used to rapidly rotate C2 infrastructure IPs
Detects Spring4Shell remote code execution exploitation attempts
Detects creation of malicious stored procedures in SQL databases
Detects VNC remote service access from external IP addresses
Detects queries to certificate transparency logs for subdomain discovery
Detects mshta.exe launched from Windows Explorer to retrieve remote HTA content over HTTP, a technique frequently observed in phishing campaigns and initial access attacks.
Detects outbound network activity to the known malicious domain sfrclak.com or IP address 142.11.206.73. This behavior may indicate malware beaconing, command-and-control communication, or interaction with attacker-controlled infrastructure.
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects HTTP POST requests where the URI contains both 'wp-content' and 'uploads', indicating potential command and control (C2) communication from a compromised website, likely a WordPress site. The rule specifically looks for requests with a body size greater than 500 bytes, suggesting data exfiltration or command execution.
Page 155 of 246