Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects DNS zone transfer attempts over TCP. It specifically looks for the byte sequence "|00 FC|" in TCP traffic destined for port 53, which is indicative of a DNS AXFR (zone transfer) request. This activity is often associated with reconnaissance by attackers to gather information about a network's DNS infrastructure.
This rule detects potential DNS tunneling activity by identifying unusually large DNS queries. Specifically, it looks for UDP packets on port 53 (DNS) that contain the DNS query header (01 00 00 01) and have a data size greater than 100 bytes. A threshold of 10 such queries from the same source within 60 seconds is set to reduce false positives.
This rule detects internal SMTP traffic that contains both 'Content-Type: application/' and 'filename=' in the email body. This combination is often indicative of an attachment being sent, and in the context of 'Lateral Phishing' (T1534), it suggests an attempt to send malicious attachments internally. The rule is set to trigger an alert if 5 such events occur from the same source IP within 300 seconds, indicating a potential automated or high-volume internal phishing attempt.
This rule detects bulk Server Message Block (SMB) file read activity from a network share. It specifically looks for TCP traffic on port 445 (SMB) from any source within the home network to any destination within the home network, indicating established connections. The rule triggers if it observes 100 or more SMB packets (identified by the content "|FF|SMB") within a 60-second window from a single source IP address. This behavior could be indicative of data collection or exfiltration from network shares.
This rule detects potential command and control (C2) communication related to disk wiping activities. It specifically looks for the keywords "wipe" and "disk" (case-insensitive) within 50 bytes of each other in TCP traffic flowing from the server to the client. This pattern suggests a C2 server instructing a compromised client to perform disk wiping, which aligns with the MITRE ATT&CK technique T1561 (Disk Wipe) under the Impact tactic.
Detects unusual network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins and encrypted data exfiltration in recently observed TA4922 campaigns.
This rule detects C2 beaconing activity originating from a potentially injected process. It specifically looks for HTTP traffic where the User-Agent header matches a common Windows Mozilla/5.0 pattern, indicating a Windows client, and the data size is between 1 and 199 bytes. A threshold of 20 such events within 60 seconds from the same source IP triggers the alert, suggesting a beaconing behavior.
This rule detects the delivery of a process injection toolkit over HTTP by looking for the presence of specific Windows API function names, 'VirtualAllocEx' and 'WriteProcessMemory', within the HTTP response body. These functions are commonly used in process injection techniques to allocate memory in a remote process and write malicious code into it.
This rule detects attempts to modify the macOS Transparency, Consent, and Control (TCC) database over an SSH connection. The TCC database stores user privacy settings, and its modification can indicate an attempt to bypass security controls or escalate privileges. The rule specifically looks for the string "TCC.db" within TCP traffic directed to port 22 (SSH).
This rule detects attempts to escalate privileges using 'sudo su -' over an SSH connection. It specifically looks for the string 'sudo su -' within TCP traffic on port 22, indicating a potential privilege escalation attempt after an SSH session has been established.
This rule detects the creation of a new domain trust via LDAP by looking for specific content in TCP traffic on port 389 (LDAP). It specifically targets HTTP POST requests containing "(objectClass=trustedDomain)" in the payload, indicating an attempt to establish a new trust relationship between domains.
This rule detects the creation of a new domain account via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) where the flow is to the server and established. The rule then inspects the content for the strings "(objectClass=user)" and "add" (case-insensitive), indicating an LDAP operation to add a new user object.
This rule detects network traffic containing the string "/etc/rc" over SSH (port 22) to a server within the home network. This pattern suggests an attempt to modify an RC script for persistence on a Linux system, potentially by an attacker who has gained SSH access.
This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.
This rule detects modifications to macOS Login Hook scripts via SSH. Login Hooks are scripts that execute when a user logs in or out, and their modification can be an indicator of persistence mechanisms used by attackers. The rule specifically looks for TCP traffic on port 22 (SSH) containing the string 'LoginHook' in a case-insensitive manner, indicating an attempt to interact with or modify these scripts.
This rule detects the string "flash write" in TCP network traffic flowing to a server, indicating a potential command to reflash component firmware. This activity could be associated with persistence techniques where an attacker modifies firmware to maintain access or control over a system.
This rule detects the creation of malicious Outlook rules via Exchange Web Services (EWS). It specifically looks for HTTP traffic to '/EWS/Exchange.asmx' containing the 'CreateRule' string in the client body, indicating an attempt to establish persistence within an Outlook environment.
This rule detects network traffic containing the string "sethc.exe" over TCP port 445 (SMB). This is indicative of an attacker attempting to exploit the 'Sticky Keys' accessibility feature for backdoor access, often by replacing the sethc.exe binary with a malicious executable. The detection specifically looks for this string in traffic flowing to the server on an established connection.
This rule detects attempts to modify default file associations via the remote registry, specifically looking for 'HKCR' (HKEY_CLASSES_ROOT) and 'shell\\open\\command' within TCP traffic on port 445 (SMB). This activity is often associated with persistence mechanisms where an attacker alters how certain file types are handled to execute malicious code.
This rule detects the remote installation of a new Windows service over SMB (Server Message Block) protocol. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "CreateService" and "svcctl" (case-insensitive). This combination indicates an attempt to create a new service remotely, which can be a method for persistence or privilege escalation by attackers.
This rule detects network traffic on TCP port 445 (SMB) containing the string 'lsasrv.dll' in a case-insensitive manner, indicating a potential attempt to modify the Domain Controller's authentication package. This activity is often associated with persistence techniques where an attacker modifies or replaces legitimate authentication packages to maintain access or elevate privileges.
Page 165 of 246