Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects network traffic that indicates a shortcut (.lnk) file is being modified or created in a 'Startup' directory, which is a common technique for establishing autostart persistence on Windows systems. The rule specifically looks for TCP traffic on port 445 (SMB) containing the strings 'Startup' and '.lnk' (case-insensitive).
This rule detects modifications to the 'com.apple.loginwindow' content over a TCP connection to port 22 (SSH). This content is associated with macOS's re-opened applications list, which can be manipulated by adversaries to establish persistence by ensuring malicious applications are launched after a user logs in or a system restarts. The detection specifically looks for the string 'com.apple.loginwindow' in the traffic, indicating an attempt to interact with or modify this critical system component.
This rule detects an attempt to exploit an unquoted service path vulnerability via an SMB file drop. Specifically, it looks for SMB traffic to port 445 on the home network containing the strings "Program Files" and ".exe" (case-insensitive). This pattern suggests an attacker might be dropping an executable file into a directory within "Program Files" that is part of an unquoted service path, which could lead to arbitrary code execution upon service restart.
This rule detects attempts to exploit DLL Search Order Hijacking vulnerabilities by monitoring SMB network traffic for requests containing '.dll' and '\AppData\' in the content. This pattern suggests an attacker might be attempting to drop a malicious DLL into a user's AppData directory on a network share, which could then be loaded by a legitimate application due to search order vulnerabilities, leading to persistence or execution of malicious code.
This rule detects attempts to hijack the PATH environment variable during an SSH session. It specifically looks for the string "export PATH=" within TCP traffic on port 22 (SSH), indicating a potential malicious modification of the PATH environment variable to control command execution paths.
This rule detects attempts to hijack the dynamic linker's LD_PRELOAD mechanism over an SSH connection. It specifically looks for the string "LD_PRELOAD" within TCP traffic on port 22 (SSH). This technique is often used by attackers for persistence or privilege escalation by injecting malicious libraries into legitimate processes.
This rule detects network traffic on port 445 (SMB) containing the strings "services.exe" and "ImagePath" (case-insensitive). This combination suggests an attempt to hijack the execution flow of a service by replacing its binary, specifically targeting the 'services.exe' process, which is a critical Windows component. The rule is designed to identify trojan activity related to persistence mechanisms.
This rule detects attempts to modify the shared library configuration file '/etc/ld.so' over an SSH connection. This activity is indicative of a shared library hijacking technique, often used for persistence or privilege escalation, where an attacker modifies the system's library loading paths to inject malicious libraries. The detection specifically looks for the string "/etc/ld.so" within TCP traffic destined for port 22 (SSH) on the home network.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This rule detects potential network port scanning activity by identifying a single source IP address attempting to connect to 10 or more distinct destination ports on a single destination IP address within a 5-minute window. This behavior is indicative of an attacker attempting to discover open services on a target host.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects attempts to remotely create or modify services on a target system via SMB, specifically looking for the 'CreateService' string within TCP traffic on port 445. It thresholds on 3 occurrences from the same source within 60 seconds to reduce false positives.
This rule detects network connections where the User-Agent or RequestClientApplication header contains "NSIS_InetLoad". This string is often associated with Nullsoft Scriptable Install System (NSIS) installers, which can be used by legitimate software but also by malware to download additional components or communicate with command and control servers. The rule specifically looks for at least 3 such connections from the same source to the same destination within the aggregated timeframe, while excluding connections to Microsoft domains to reduce false positives.
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
This rule detects attempts to retrieve the running configuration of a network device via an SSH session. It specifically looks for the case-insensitive string "show running-config" in TCP traffic destined for port 22 (SSH) on the home network, indicating a potential administrative action or reconnaissance activity.
This rule detects attempts to perform lateral movement using the MMC20 COM object via DCOM. It specifically looks for TCP traffic destined for port 135 (typically used by DCOM) containing the string "MMC20.Application" in a case-insensitive manner. This indicates an attempt to instantiate the MMC20.Application COM object, which can be abused for remote code execution and lateral movement.
This rule detects potential HID (Human Interface Device) keystroke injection attacks via USB emulation. It specifically looks for HTTP client body content containing both the terms 'keyboard' and 'inject' (case-insensitive). This pattern suggests an attempt to simulate keyboard input, often associated with devices like 'BadUSB' or 'Rubber Ducky' that emulate a keyboard to deliver malicious keystrokes.
This rule detects the remote installation of a new systemd service unit. It specifically looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "/etc/systemd/system/" and ".service" (case-insensitive). This combination suggests that a new systemd service file is being transferred or created remotely, which could indicate an attacker establishing persistence or escalating privileges.
This rule detects attempts to access named pipes via Server Message Block (SMB) on port 445. It specifically looks for the SMB signature and the 'IPC$' string within the traffic, indicating an attempt to establish an Inter-Process Communication (IPC) connection. A threshold is set to trigger an alert if 10 such events occur from the same source within 30 seconds, which could indicate enumeration or exploitation attempts.
This rule detects an anomaly in Kerberos authentication attempts by monitoring TCP traffic to port 88 (Kerberos). It triggers an alert if a source IP address attempts Kerberos authentication 30 or more times within a 10-second window, indicating a potential brute-force or rapid authentication attempt against a domain account.
This rule detects Address Resolution Protocol (ARP) poisoning attempts on a network segment, specifically looking for ARP reply packets (opcode 2). It uses a thresholding mechanism to trigger an alert if 10 such packets are observed from the same source within a 5-second window, indicating a potential malicious ARP spoofing activity.
Page 166 of 246