Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects attempts to modify Cisco router firmware using ROMMONkit. It specifically looks for TCP traffic to the HOME_NET on port 23 (Telnet) containing the case-insensitive strings "rommon" and "tftpdnld". This combination suggests an attempt to interact with the router's ROM Monitor mode for firmware manipulation, often associated with malicious activities like installing backdoors or persistent malware.
This rule detects network traffic on port 445 (SMB) containing the strings "LSASS" and "AddDll" (case-insensitive). This combination of strings suggests an attempt to register a malicious DLL with the Local Security Authority Subsystem Service (LSASS) for persistence, a technique often used by malware to maintain access on a compromised system. The flow is set to 'to_server' and 'established', indicating an outgoing connection from the monitored network to a server, and that the TCP connection has been successfully established.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive strings "powercfg" and "change". This combination suggests an attempt to modify system power settings, potentially to prevent a system from sleeping or shutting down, which could be a persistence mechanism.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "icacls" and "grant" (case-insensitive). This combination suggests an attempt to modify file or directory permissions, specifically granting permissions, which could be indicative of an attacker exploiting a service binary file permission weakness to establish persistence or elevate privileges. The rule is triggered when these strings are observed in traffic flowing to the server.
This rule detects attempts to write shell event hook scripts, specifically those using 'trap' and 'SIGHUP', over an SSH connection. This activity is often associated with persistence mechanisms where an attacker sets up a script to execute upon certain shell signals, such as a hangup signal, to maintain access or execute malicious code.
This rule detects network traffic indicative of a remote WMI event subscription being registered. Specifically, it looks for TCP traffic on port 135 (typically used by Microsoft RPC and DCOM, which WMI can leverage) directed to the home network, containing the string "__EventConsumer" case-insensitively. This activity can be a sign of persistence mechanisms being established by attackers.
This rule detects attempts to register a new system service via a remote SSH connection. It specifically looks for the string "service install" within TCP traffic on port 22 (SSH) flowing from a client to a server within the home network. This activity could indicate an attacker establishing persistence on a compromised system.
This rule detects when a cron job is created or modified via a remote SSH session. It specifically looks for the string "crontab -e" within TCP traffic destined for port 22 (SSH), indicating an interactive session where a user is editing their crontab file. This activity, when originating from a remote SSH session, could be indicative of an attacker establishing persistence or scheduling malicious tasks on a compromised system.
This rule detects potential API injection payloads, specifically looking for the strings "CreateRemoteThread" and "OpenProcess" within HTTP response data. These API calls are commonly used in techniques like process injection to execute malicious code within another process. The rule is designed to identify the delivery of such payloads to client systems.
This rule detects the string "launchctl load" within TCP traffic on port 22 (SSH). This indicates an attempt to load a launchd service on a macOS or Linux system via a remote SSH connection. This activity could be legitimate system administration but also could be indicative of an attacker establishing persistence or executing malicious services.
This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.
This rule detects TFTP (Trivial File Transfer Protocol) traffic on UDP port 69, specifically looking for a content pattern that indicates a firmware push. The pattern '|00 02|' at the beginning of the UDP payload suggests a TFTP write request (opcode 2), which is commonly used for uploading files, including firmware, to network devices. The rule is designed to alert on such activity directed towards the local network ($HOME_NET).
Detects browser processes making DNS queries or network connections to BNB Smart Chain RPC endpoints (and related EVM-compatible chain RPCs). This technique is a signal for EtherHiding-style attacks where malicious JavaScript injected into compromised websites queries smart contracts for payload retrieval. This generalizes beyond ClearFake to catch UNC5342 (North Korean DPRK) and other EtherHiding adopters documented since October 2025.
This rule detects Address Resolution Protocol (ARP) announcements from new or unknown devices on the network. Specifically, it looks for ARP packets with an opcode of '2', which signifies an ARP reply. The rule uses a threshold to trigger an alert if a new ARP reply is observed from a source within a 5-second window, indicating a potential new device joining the network or an attempt at ARP spoofing.
This rule detects indicators of compromise (IOCs) associated with the Red Lamassu (JFMBackdoor) campaign. It identifies malicious file hashes, network communication with known command and control (C2) domains and IP addresses, specific file paths and names used by the malware, and registry modifications for persistence. The rule looks for file events, process creations, network connections, and registry changes that match the defined IOCs.
Detects curl making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
Detects exploitation attempts of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257) by monitoring for specific Indicators of Compromise (IOCs) including source IPs, machine names, and MAC addresses.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
Detects the creation of a file on a server system by common network utilities (curl, ftp, powershell, winscp, certutil) within a 5-minute window of a network connection to common ports (21, 22, 80, 443). This could indicate ingress tool transfer or data exfiltration attempts.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
Detects Microsoft Teams messages containing links to Pastebin. Threat actors (e.g., Nimbus RAT operators) use Pastebin to host instruction checklists and payload URLs during vishing attacks.
Page 171 of 246