Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
This rule detects potential lateral movement attempts using alternate authentication material, specifically NTLMSSP, over SMB (port 445). It triggers an alert if five or more NTLMSSP authentications are observed from a single source IP address to the home network within a 30-second window. This behavior can indicate an attacker attempting to authenticate to multiple systems using stolen credentials or hashes.
This rule detects attempts to access physical drives directly over SMB by looking for the string "\\.\PhysicalDrive" in TCP traffic on port 445. This technique can be used by attackers to bypass file system access controls and directly read or write to disk sectors, often as part of defense evasion or data exfiltration.
This rule detects network traffic containing the strings "bcdedit" and "safeboot" over TCP port 445 (SMB). This combination suggests an attempt to remotely configure a system to boot into safe mode, which could be used by an attacker for defense evasion or to facilitate further malicious activities.
This rule detects network traffic containing the string "/..namedfork/rsrc" (case-insensitive) over TCP to port 22 (SSH). This pattern is indicative of an attempt to use macOS resource forks to hide payload data, a technique often employed by malware for defense evasion. The detection specifically targets traffic originating from and destined for the home network, suggesting an internal system attempting to exfiltrate or receive hidden data.
This rule detects attempts to unset the HISTFILE environment variable over a TCP connection to port 22 (SSH). Unsetting HISTFILE is a common technique used by attackers to prevent their commands from being recorded in the shell history, thereby evading detection and forensic analysis. The rule specifically looks for the string "unset HISTFILE" case-insensitively within the TCP stream.
This rule detects attempts to clear the Bash history using the 'history -c' command over an established SSH connection. It specifically looks for the case-insensitive string 'history -c' within TCP traffic flowing from the client to the server on port 22 (SSH). This activity is often associated with an attacker attempting to cover their tracks after gaining unauthorized access.
This rule detects network traffic over SMB (port 445) that contains patterns indicative of a payload hidden within an NTFS Alternate Data Stream (ADS). Specifically, it looks for the string ":$DATA" followed by ".exe" (case-insensitive) in the TCP payload, which is a common technique used by malware to conceal executable files within legitimate files.
This rule detects attempts to move executable files (.exe) over SMB (Server Message Block) by looking for the 'MoveFile' string and the '.exe' extension in network traffic on port 445. This activity could indicate malware being relocated on a network share.
This rule detects the delivery of a payload that uses InstallUtil for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "System.Configuration.Install" and "Installer" (case-insensitive) within the file data. This pattern is indicative of malicious use of InstallUtil, a legitimate Microsoft utility, to execute code, often for defense evasion.
This rule detects attempts to extract credentials from the Linux /proc filesystem over an SSH connection. Specifically, it looks for network traffic containing "/proc/", "/mem", and "ssh" (case-insensitive) within the same TCP flow to a server on port 22. This combination suggests an attacker might be trying to read sensitive memory regions or files related to SSH processes to dump credentials.
This rule detects attempts to access cached domain credentials via the Windows Registry over the SMB protocol (port 445). It specifically looks for the string "SECURITY\Cache" within TCP traffic directed to the HOME_NET on port 445, indicating a potential credential access attempt.
This rule detects attempts to read the bash history file, typically using the 'cat ~/.bash_history' command, over a TCP connection to port 22 (SSH). This activity is often associated with credential harvesting by an attacker who has gained access to a system and is looking for sensitive information, such as previously entered commands that might contain passwords or other credentials.
This rule detects when a KeePass database file (.kdbx) is copied to a server via SMB. This could indicate an attempt to exfiltrate sensitive credential data.
This rule detects attempts to access the Windows Credential Manager Vault remotely over TCP port 445 (SMB). It specifically looks for the string "vaultcmd" in the network traffic, which is a command-line utility used to manage credentials in the Credential Manager. This activity could indicate an attacker attempting to extract stored credentials from a compromised system.
This rule detects network traffic to a specific URI path associated with Active Directory Certificate Services (AD CS) enrollment. The URI '/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP' is known to be used in Certificate Enrollment Policy (CEP) web services, which can be abused in ESC1 (ESC1 Certificate Template Privilege Escalation) attacks to obtain certificates with elevated privileges. The rule specifically looks for TCP traffic on port 443 (HTTPS) to this URI, indicating an attempt to interact with the CEP service.
This rule detects the exfiltration of Kerberos credential cache (ccache) files over SSH SCP. It specifically looks for the string "KRB5CCNAME" within TCP traffic on port 22 (SSH), indicating the potential transfer of a ccache file, which often contains this environment variable name.
This rule detects when a Kerberos credential cache (ccache) file is copied over SMB. Attackers may attempt to steal Kerberos ccache files to obtain Kerberos tickets, which can then be used for various credential access attacks like 'Pass the Ticket'. The rule specifically looks for the string '.ccache' within SMB traffic on port 445, indicating the transfer of such a file.
This rule detects an AS-REP Roasting attack where pre-authentication is not required. It specifically looks for UDP traffic on port 88 (Kerberos) containing specific byte sequences associated with this attack technique. The rule uses a threshold to prevent excessive alerts from a single source.
This rule detects network traffic indicative of an 'Evil Twin' access point credential capture portal. It specifically looks for HTTP POST requests where the URI contains both 'wifi' and 'password' (case-insensitive). This pattern suggests a malicious portal designed to trick users into entering their Wi-Fi credentials.
Detects network connections to Hugging Face domains initiated by Node.js. This behavior is associated with a North Korean-linked npm infostealer campaign that abuses the legitimate AI/ML platform to host its second-stage payload and receive exfiltrated stolen data archives, bypassing standard reputation-based network filtering.
Page 163 of 246