Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects when an SNMP OID request is made to an OpenCanary honeypot's SNMP service. This indicates an adversary is likely performing reconnaissance to gather information about the network or devices, potentially looking for vulnerabilities or sensitive data.
Detects instances where a TFTP service on an OpenCanary honeypot node has received a request. This indicates potential reconnaissance or attempts to interact with a seemingly vulnerable service.
This rule detects when a user bypasses Chrome Safe Browsing warnings for potentially dangerous content or downloads. It specifically looks for events where Chrome Management reports a bad navigation event, dangerous download event, content transfer event, or unscanned file event, and the security result indicates the event was 'BYPASSED' by the user. The rule also assigns a risk score based on the category of the bypassed threat, with higher scores for malware, dangerous hosts, and social engineering.
Detects a network connection that was initiated from a PowerShell process. Malicious PowerShell scripts often download additional payloads or communicate back to command and control channels via uncommon ports or IPs. This rule can be used as a basis for hunting for anomalies.
This rule identifies outbound network connections to Autonomous System Numbers (ASNs) that are present in a predefined watchlist named 'suspicious_asn'. It leverages geo-IP enrichment to extract the ASN of the target IP address and compares it against the watchlist. The rule is designed to detect communication with potentially malicious or suspicious network infrastructure.
This rule detects a suspicious sequence of events: a process launching with a low prevalence executable (meaning it's rarely seen in the environment) followed by that same process initiating an HTTP connection to a low prevalence domain (a domain rarely accessed in the environment) within a 10-minute window. This combination can indicate the execution of novel or custom malware attempting to establish command and control or exfiltrate data to an unusual destination.
This rule detects successful API executions within Google Cloud Platform (GCP) that originate from an IP address identified as a Tor exit node. It correlates GCP Cloud Audit logs, specifically looking for 'ALLOW' actions, with a GCTI (Google Cloud Threat Intelligence) feed that lists known Tor exit node IP addresses. The rule also calculates a risk score, with additional weight given if the originating IP is from certain high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
This rule identifies outbound network connections to a specific Autonomous System Number (ASN). The rule is designed to detect suspicious network traffic that might indicate command and control activity, data exfiltration, or other malicious communications originating from the monitored environment to an ASN that has been deemed suspicious. The specific ASN to monitor is configured within the rule.
This rule detects Command and Control (C2) activity identified by AWS GuardDuty across Amazon EC2, AWS Lambda, or Amazon EKS Runtimes. It specifically looks for GuardDuty findings with a product event type matching 'C&CActivity' and filters out sample findings. The rule aims to alert on suspicious communication patterns that indicate an adversary is controlling compromised resources within the AWS environment.
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
Suspicious ASN
YARA-L
Identify network traffic based on a specific ASN
Suspicious ASN Watchlist
YARA-L
Identify any network connections to a list of ASNs
Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.
This rule detects the PygmyGoat backdoor on Linux systems by identifying specific byte patterns associated with its functionality. The patterns include code for creating backdoor sockets, forwarding data, the main constructor, and hooking the accept function, indicating the presence and activity of the PygmyGoat malware.
Amazon GuardDuty detects an Amazon EC2 instance or a container querying algorithmically generated domains (DGA).
Identify network traffic based on target country
Amazon GuardDuty detects an Amazon EC2 instance or a container attempting to communicate with a black hole IP address.
Amazon GuardDuty detects Tor Network activity in an AWS account.
Provides example usage of WHOIS data, detecting a DNS query for a domain that contains a specific string and is not registered with the defined domain registrar.
Detects the execution of rundll32.exe that leads to an external network connection, specifically looking for known processes used by the Pikabot malware family for command and control (C2) communication. This rule identifies suspicious network activity originating from rundll32.exe when its parent process is one of the specified Windows binaries, which Pikabot has been observed to hijack for C2.
Detects potential Command and Control (C2) communication activity associated with the Peach Sandstorm APT group. The rule specifically looks for HTTP GET requests to '/api/Core/Command/Init' or '/api/Core/Command/Restart' endpoints, which are indicators of this group's C2 infrastructure.
Page 238 of 246