Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects Kerberoasting activity, specifically looking for multiple Kerberos Ticket Granting Service (TGS) requests over UDP port 88 within a short timeframe from the same source IP. Kerberoasting is a post-exploitation technique used by attackers to obtain service principal name (SPN) hashes, which can then be cracked offline to retrieve the associated plaintext passwords. The rule uses a threshold of 20 TGS requests within 10 seconds from a single source to identify this suspicious behavior.
This rule detects a possible port knocking sequence, which is a method of externally opening ports on a firewall by generating a sequence of connection attempts to a set of closed ports. The rule specifically looks for 5 TCP SYN packets from the same source IP within a 5-second window to any port on the home network, indicating a potential port knocking attempt.
This rule detects the presence of GRE (Generic Routing Encapsulation) tunnel traffic (IP protocol 47) originating from any source IP address to the local network. It triggers an alert if three such GRE packets are observed from the same source within a 60-second window. This could indicate an attempt to establish a GRE tunnel, potentially for defense evasion or to bypass network security controls.
This rule detects an ICMP flood Denial of Service (DoS) attack. It triggers an alert when more than 200 ICMP echo request (type 8) packets are observed targeting a single destination within a 5-second window. This high volume of ICMP traffic is indicative of an attempt to overwhelm a target system or network, leading to service disruption.
Monitors for network connections originating from the VSCode extension host process to GitHub API endpoints immediately following a new extension installation. This may indicate token exfiltration or repository enumeration from a malicious extension.
Detects DNS requests to domains matching known UNC3753 data leak sites or phishing domains masquerading as IT helpdesks, serving as an early warning of an ongoing vishing campaign or active extortion.
Detects network connections or web proxy requests to malicious domains (such as colafunfacts.net) known to host initial droppers, decoy pages, and payload archives for the ClickFix RAT campaigns.
Detects HTTP/DNS network traffic attempting to download the Bun runtime from the specific GitHub releases path. This behavior is exhibited by the malicious Python loader in the Hades PyPI supply chain attack to stage its execution environment.
This rule detects an unusually high volume of successful network connections over SMB (ports 135, 139, 445) originating from a single account within a one-hour window. This behavior can be indicative of lateral movement, reconnaissance, or data exfiltration activities using SMB/RPC.
This rule detects when a single account initiates 5 or more successful Remote Desktop Protocol (RDP) connections within a one-hour window. This behavior can be indicative of an adversary attempting to gain widespread access within a network, potentially through credential stuffing, brute-force attacks, or lateral movement using compromised credentials.
Detects use of stolen legitimate code signing certificates on suspicious binaries
Detects Office documents fetching remote templates for template injection attacks
Detects repeated SSH connections used to grab banners for host information gathering
Detects CONNECT tunneling via compromised VPS servers used as proxy relay
Detects modification of network device system images via TFTP for persistent backdoors
Detects SNMP-based access to network device configurations for data collection
Detects automated scraping of staff and employee directory pages
Detects reuse of alternate authentication materials like tokens or cookies
Detects port knocking sequences used to activate hidden network backdoors
Detects DNS lookups to typosquatted package registry domains for supply chain attacks
Detects sustained high-rate web access used to determine business operating hours
Page 159 of 246