Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network traffic to the specific 'amos-trading' Bitbucket repository used by a threat actor to host trojanized STX RAT installers. This activity is indicative of a supply chain compromise where malicious software is distributed via a legitimate-looking source.
This rule detects a recurring download pattern associated with Microsoft BITS (Background Intelligent Transfer Service). Specifically, it looks for HTTP traffic where the User-Agent header contains "Microsoft BITS" and triggers an alert if 10 such events occur within 3600 seconds from the same source IP address. This pattern can indicate an adversary using BITS for persistent downloads, potentially for malware delivery or command and control.
This rule detects SMB authentication attempts that might be indicative of a 'Pass-the-Hash' attack (ATT&CK T1550.002). It specifically looks for NTLMSSP (NT LAN Manager Security Support Provider) traffic on TCP port 445 (SMB) where the NTLM authentication message contains a specific sequence of null bytes, which can be characteristic of a hash being passed instead of a cleartext password.
This rule detects suspicious TLS certificates that are self-signed and potentially used for Command and Control (C2) communication. Specifically, it looks for TLS certificates where both the issuer and subject country codes are 'US' and the common name (CN) in the subject field consists of 8 or more hexadecimal characters. This pattern is often observed in malware using dynamically generated self-signed certificates for C2.
This rule detects attempts to exploit a vulnerability in the Windows Search URI handler that can lead to NTLM credential leaks. It specifically looks for network events where the `RemoteUrl` contains 'search:' or 'search-ms:' along with parameters like 'query=' or 'crumb='. This indicates an attempt to trigger the Windows Search functionality with crafted URI parameters, which could force the system to authenticate to an attacker-controlled server using NTLM.
ClickFix Payload Domain Network Traffic
Cortex XDR
Detects network connections or DNS queries to colafunfacts.net, a domain known to host malicious droppers disguised as logs and browser zip files in ClickFix campaigns.
Detects an initial payload downloader, specifically 'Browser_Updater.exe', initiating network connections to retrieve an MSI payload disguised as an 'iis.jpg' file. This rule identifies suspicious network activity based on the process name and specific network indicators (IP address or URL pattern).
Detects wscript.exe initiating outbound network connections to non-standard HTTP ports (ports other than 80, 443, or 8080), which aligns with JS.MonoGlyphRAT's C2 communication profile.
This rule detects cryptomining activity by identifying the Stratum protocol's 'mining.subscribe' message over TCP port 3333. The Stratum protocol is commonly used by cryptocurrency miners to communicate with mining pools. Detection of this specific message indicates an attempt to initiate or participate in cryptomining operations, potentially on a compromised system.
This rule detects attempts to modify web server files, specifically 'index.html' within a 'wwwroot' directory, over the Server Message Block (SMB) protocol. The detection is based on the presence of these strings in network traffic directed to port 445 (SMB) on the internal network. This activity could indicate an attacker attempting to deface a web server or inject malicious code.
This rule detects a high volume of TCP traffic on port 445 (SMB) directed to the home network, specifically looking for the SMB protocol signature. The threshold of 500 connections within 30 seconds from a single source IP suggests an attempt at mass file deletion or disk wiping activity on network shares, often associated with ransomware or destructive malware.
This rule detects a TCP connection flood, specifically looking for a high rate of TCP SYN packets (indicated by the 'flags:S' keyword) directed towards a single destination IP address within a short timeframe. A threshold of 500 SYN packets within 5 seconds to the same destination triggers the alert. This behavior is characteristic of a Denial of Service (DoS) attack, aiming to exhaust the target's resources by overwhelming it with connection requests.
This rule detects HTTP POST requests that are likely associated with financial transaction hijacking by banking Trojans. It specifically looks for HTTP POST requests where the host header or URI contains keywords related to banking or payment services (bank, paypal, stripe, wise, transferwise) and the URI also contains the word 'transfer'. Additionally, the request body size must be greater than 200 bytes, indicating a substantial data transfer, which is common in financial transactions.
This rule detects attempts to manipulate stored records within an MSSQL database. It specifically looks for TCP traffic directed to port 1433 (the default MSSQL port) containing the keywords "UPDATE" and "SET" (case-insensitive) in the flow to the server. A threshold of 50 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating potential bulk data modification.
Detects termination of cloud instances to destroy forensic evidence
This rule detects HTTP access to domains or hosts associated with bulletproof hosting infrastructure. It specifically looks for hostnames containing '.ru/', '.cn/', 'frantech', 'serverius', or 'combahton'. A threshold of 5 occurrences within 60 seconds from the same source IP triggers the alert.
This rule detects HTTP POST requests with a client body that appears to be RC4 symmetric encrypted C2 beacon traffic. It specifically looks for HTTP traffic flowing to the server, with a client body between 100 and 500 bytes in size, and whose content matches a PCRE regex for base64 encoded strings. The rule is thresholded to trigger if 20 such events occur from the same source IP within 60 seconds, indicating potential beaconing activity.
This rule detects non-DNS traffic attempting to use port 53, which is typically reserved for DNS queries. This behavior is often indicative of command and control (C2) evasion techniques, where attackers tunnel their C2 communications over a commonly allowed port to bypass firewalls and network monitoring. The rule specifically looks for TCP traffic to port 53 that is not identified as DNS application-layer protocol, originating from the home network, and establishes a flow. A threshold of 5 such events within 30 seconds from the same source IP triggers the alert.
This rule detects the use of SSH multiplexing, specifically the 'ControlMaster' feature, which can be leveraged for session hijacking. It triggers when the string 'ControlMaster' is observed in TCP traffic on port 22 (SSH) within the home network, indicating an attempt to establish or utilize an SSH multiplexing control channel. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects potential SSH session hijacking attempts that leverage agent forwarding abuse. It specifically looks for a byte sequence within the SSH traffic that could indicate such an attack. The rule targets TCP traffic on port 22 (SSH) flowing from the client to the server, ensuring the connection is established.
This rule detects network traffic where an HTTP request is made to 'ssm.amazonaws.com' with the URI containing 'StartSession'. This combination indicates the initiation of an AWS Systems Manager (SSM) Session Manager session, which can be used for legitimate remote administration but also for lateral movement by attackers.
Page 156 of 246