Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects attempts to dump memory from the 'securityd' process on macOS systems, specifically looking for the string 'securityd' and 'ptrace' in TCP traffic on port 22. This activity is indicative of credential access attempts, as 'securityd' handles sensitive security information.
This rule detects attempts to dump the macOS Keychain via a remote SSH connection. It specifically looks for the string "security dump-keychain" within TCP traffic on port 22 (SSH). This command is used to extract credentials and other sensitive information stored in the macOS Keychain.
Detects network traffic to known Command and Control (C2) IP addresses and ports associated with the ClickFix Python RAT.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
Detects suspicious network connections to a non-existent Anthropic API endpoint (api.anthropic.com/v1/api). This specific route is used as network camouflage and decoy traffic by the Hades PyPI supply chain malware campaign.
This rule detects potential path traversal attempts against an IIS web server by looking for sequences like '../' or '..\\' in the URI query string. It triggers an alert if five or more such attempts are observed from a single IP address within an hour, indicating a possible malicious scanning or exploitation attempt.
Detects unusual network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins and encrypted data exfiltration in recently observed TA4922 campaigns.
This rule detects network connections initiated by the 'teams.exe' process to public IP addresses. It specifically looks for outbound connections from the Microsoft Teams application to external, non-private IP ranges. This could be used to monitor unusual external communication patterns from Teams, although the specific intent without further context is unclear.
UNC3753 Infrastructure Connection
Cortex XDR
Detects DNS requests to domains matching known UNC3753 data leak sites or helpdesk impersonation patterns utilized during vishing campaigns. This rule specifically looks for the domain "business-data-leaks.com" and domains ending with "-itdesk.com", "-helpdesk.com", or "-it.com".
Identifies mshta.exe accessing externally hosted HTA content from a user-initiated Explorer session, potentially indicating malicious remote code execution.
Detects non-browser processes making DNS queries to the Telegram Bot API. This activity is indicative of malware using Telegram for Command and Control (C2) communications or data exfiltration, such as Amnesia RAT.
This rule detects a specific HTTP POST request pattern associated with the Mirai botnet's check-in mechanism. It looks for HTTP POST requests to the '/report' URI with a body size between 21 and 99 bytes. A threshold of 10 such requests from the same source within 60 seconds triggers the alert, indicating potential botnet activity.
This rule detects potential automated social media account creation attempts by monitoring HTTP traffic for requests to common social media platforms (twitter.com, x.com, facebook.com) that include 'signup' in the URI. A threshold of 5 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible automated or high-volume registration process.
This rule detects potential domain fronting by identifying a mismatch between the Server Name Indication (SNI) field in the TLS handshake and the Host header, specifically when the SNI field contains domains commonly used for content delivery networks (CDNs) like cloudfront.net, azureedge.net, or fastly.net. This technique can be used to obfuscate the true destination of network traffic, often for malicious purposes such as bypassing censorship or exfiltrating data.
This rule detects attempts to execute commands via an unauthenticated Docker API. Specifically, it looks for HTTP POST requests to the '/exec' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker daemon access. This could indicate an attacker attempting to gain control or execute arbitrary commands within Docker containers or the host system.
This rule detects attempts to exploit the Heartbleed vulnerability (CVE-2014-0160) by identifying a specific pattern in TLS heartbeat requests. It looks for a TLS heartbeat request with a type of 0x18 (heartbeat request) and a length greater than 3 bytes, which is indicative of an oversized heartbeat request used in the Heartbleed exploit.
This Suricata rule detects Kerberos unconstrained delegation abuse by looking for a specific byte sequence in UDP traffic destined for port 88 (Kerberos). The byte sequence '|a0 03 02 01 05 a1 03 02 01 0d|' is indicative of a specific Kerberos message structure that can be associated with unconstrained delegation. Unconstrained delegation allows a service to impersonate any user to any other service on the network, which can be abused by attackers for privilege escalation and lateral movement.
This rule detects attempts to modify Group Policy Objects (GPOs) over Server Message Block (SMB) by looking for HTTP PUT requests containing '\SYSVOL\' and '\Policies\' in the URI. This activity can indicate an adversary attempting to escalate privileges or establish persistence within an Active Directory domain.
This Suricata rule detects HTTP requests containing 'VBoxService' in the URI. This string is associated with VirtualBox Guest Additions, which are often installed in virtualized environments. The presence of such a string in network traffic can indicate that a system is a virtual machine, which attackers or malware might query to detect if they are running in a sandbox or virtualized analysis environment. This detection is categorized as 'trojan-activity' and is related to discovery tactics.
Page 169 of 246