Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.
This rule detects bulk account deletion attempts via LDAP. It triggers when multiple LDAP requests (at least 5 within 30 seconds from the same source IP) are observed on port 389, containing both 'userAccountControl' and 'delete' keywords, indicating an attempt to modify user account control attributes to disable or delete accounts.
This rule detects a potential SSL/TLS Handshake Exhaustion Attack. It triggers when a high volume of TCP SYN packets (flags:S) are observed targeting port 443 (HTTPS) on the home network within a short timeframe. Specifically, it looks for more than 200 SYN packets to the same destination within a 5-second window, indicating an attempt to overwhelm the server with handshake requests, leading to a denial of service.
This rule detects potential command and control (C2) communication over SMTP by looking for repeated 'EHLO' commands within a short timeframe from the same source IP address. The threshold is set to trigger if 10 'EHLO' commands are observed within 300 seconds (5 minutes) from a single source.
This rule detects potential command and control (C2) beaconing activity over HTTP. It specifically looks for HTTP POST requests with a content size between 50 and 300 bytes that occur at a regular interval (15 times in 60 seconds) from a single source IP address. This pattern is often indicative of malware communicating with a C2 server.
This rule detects attempts to modify stored data within a MySQL database, specifically looking for 'UPDATE' and 'WHERE' clauses in TCP traffic directed to the MySQL default port (3306). It triggers an alert if 50 such events are observed from the same source IP within a 30-second window, indicating potential malicious activity aimed at data integrity compromise.
This rule detects potential command and control (C2) activity where commands are being read from a removable media share over SMB. It specifically looks for SMB traffic containing the string "USBSTOR" (case-insensitive) and ".txt" (case-insensitive), indicating access to text files on a USB storage device. A threshold of 5 occurrences within 30 seconds from the same source IP is applied to reduce false positives.
This rule detects the use of an internal proxy server to route C2 (Command and Control) traffic. Specifically, it looks for HTTP CONNECT requests within the internal network ($HOME_NET to $HOME_NET) that are established and occur at a high frequency (10 times in 60 seconds from the same source). This pattern is indicative of a system inside the network attempting to tunnel C2 communications through an internal proxy.
This rule detects non-HTTP traffic being tunneled over TCP port 80. It specifically looks for established TCP connections to port 80 where the application layer protocol is not identified as HTTP and the data payload size is greater than 100 bytes. A threshold is applied to trigger an alert if 10 such events occur from the same source IP within 60 seconds. This behavior is often indicative of command and control (C2) communication or data exfiltration attempting to blend in with legitimate web traffic.
This rule detects a high volume of DNS NXDOMAIN (Non-Existent Domain) responses originating from a single source IP address within a short timeframe. This pattern is indicative of Domain Generation Algorithm (DGA) activity, often used by malware for command and control (C2) beaconing. The threshold is set to trigger if 20 NXDOMAIN responses are observed from the same source within 60 seconds.
This rule detects HTTP POST requests to 'management.azure.com' with a URI containing 'bastionHosts'. This pattern indicates an attempt to establish a direct VM connection via Azure Bastion, which could be used for lateral movement within an Azure environment.
This rule detects a high volume of Registry Hive bulk queries for system reconnaissance activities. Specifically, it looks for 30 or more 'RegEnumKey' operations over TCP port 445 (SMB) within a 30-second window, originating from a single source IP address and directed towards the protected network. This behavior can indicate an attacker attempting to enumerate registry keys to gather information about the system.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This rule detects network connections or DNS queries made to the domain 'data-seed-prebsc-1-s1.binance.org'. This domain is associated with the Binance Smart Chain testnet. Connections to such domains from enterprise environments might indicate unauthorized cryptocurrency-related activities, potential malware beaconing, or other policy violations.
This rule detects attempts to install a kernel module (rootkit) on a Linux system via an SSH session. It specifically looks for the 'insmod' command followed by a '.ko' file extension within TCP traffic destined for port 22 (SSH). This combination suggests an attacker is trying to load a malicious kernel object.
This rule detects attempts to push a root certificate to a Windows system via the Remote Registry service (SMB port 445). It specifically looks for network traffic containing the strings "Root\Certificates" and "RegSetValue" (case-insensitive) within the same TCP flow to a server on port 445. This activity could indicate an attacker attempting to establish persistence or bypass security controls by installing a trusted root certificate.
This rule detects network traffic on TCP port 445 (SMB) containing the string "wintrust.dll" in a case-insensitive manner. This specific DLL is associated with Windows Trust Provider functionality. The detection is flagged as 'trojan-activity' and is linked to MITRE ATT&CK technique T1553.003 (Code Signing: Code Signing Policy Modification) and tactic Defense Evasion, suggesting an attempt to bypass code signing policies by replacing or manipulating the wintrust.dll.
This Suricata rule detects network traffic on TCP port 445 (SMB) that contains the strings "SpecialAccounts" and "UserList" (case-insensitive). This pattern is indicative of an attempt to hide a user account on a Windows system by modifying the registry's SpecialAccounts\UserList key. This technique is often used by adversaries for defense evasion.
This rule detects attempts to remove a network share connection using the 'NetUseDel' command. This activity is often associated with adversaries trying to hide their access or clean up traces after establishing persistence or performing other actions on a compromised system. The detection specifically looks for the 'NetUseDel' string within TCP traffic directed to port 445 (SMB/CIFS), indicating an attempt to delete a network share.
This rule detects TCP traffic to port 389 (LDAP) where the content of the packet contains both "sAMAccountName" and "admin" (case-insensitive). This combination suggests an attempt to query or manipulate an LDAP directory for an account named 'admin' using the sAMAccountName attribute, potentially indicating user account masquerading as a service account or reconnaissance activity.
This rule detects the string "setfattr" in TCP traffic destined for port 22 (SSH). The presence of "setfattr" in SSH traffic might indicate an attempt to use Linux extended attributes to hide data or malicious payloads, a technique often associated with defense evasion.
Page 174 of 246