Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, and regasm.exe when their command line contains suspicious keywords like 'download', 'http', or 'encode'. This activity can indicate an attempt to download malicious payloads or bypass security controls.
This rule detects potentially unauthorized or suspicious WebSocket connections established over TCP port 1313. It specifically looks for Socket.IO traffic utilizing the 'EIO=4' protocol version and 'websocket' transport, while explicitly checking for the absence of Authorization headers and Sec-WebSocket-Protocol headers. The pattern matching on the raw payload suggests identification of initial handshake or messaging sequences (e.g., '0{' or '40') indicative of unauthenticated interaction with a WebSocket service.
This rule detects potential RDP lateral movement by identifying accounts that log on to multiple distinct workstations via RDP (LogonType 10) within a one-hour window, where the workstation name is different from the computer name. A logon chain of more than two distinct computers for the same account and IP address within an hour is flagged as suspicious.
This rule detects potential lateral movement attempts originating from IIS web servers (identified by 'w3wp.exe' as the initiating process) to other internal IP addresses using common lateral movement ports (SMB, RDP, WinRM, SSH). It specifically looks for successful network connections from an IIS server to a private IP address on one of the specified ports, where the remote IP is not the local IP.
Detects the use of the 'diagnose sniffer packet' command on FortiOS, or evidence of the FortigateSniffer tool (associated with past FortiGate vulnerabilities). This behavior is indicative of unauthorized packet capture and potential credential sniffing on network infrastructure devices.
This rule detects a suspicious network connection on local port 1313 followed within 5 minutes by a PowerShell network connection to a non-standard port (not 80, 443, 8080, 8443). This behavior is characteristic of an initial exploit attempt targeting a service on port 1313, followed by a post-exploitation reverse shell.
This rule detects network connections on TCP port 1313 that explicitly use the Socket.IO protocol for WebSocket communication (URI path containing '/socket.io/?EIO=4&transport=websocket'). This pattern may indicate the presence of command and control (C2) traffic, web shells, or unauthorized application communications leveraging WebSocket tunnels over non-standard ports.
Detects Server-Side Request Forgery (SSRF) attempts against a GCP Cloud Run service. The rule identifies malicious payloads targeting the 'url' parameter, which utilize path traversal sequences (e.g., ../, %2f, %5c) to escape the GitHub repository segment or attempt to access sensitive local system files like /proc/self/environ, /app/main.py, or /app/requirements.txt.
Detects Server-Side Request Forgery (SSRF) attempts using a double-slash URL manipulation technique. Adversaries append an absolute local file path (e.g., /etc/passwd or /proc/self/environ) after a GitHub blob URL to bypass URL validation logic commonly found in web proxies, API gateways, and serverless environments like GCP Cloud Run.
Detects TFTP boot image transfers to network devices for persistent firmware modification
This rule detects network connections or DNS queries originating from common web browsers (chrome.exe, msedge.exe, chromium.exe) towards domains related to Perplexity AI. Such activity may indicate data exfiltration or the use of AI tools for processing sensitive organizational data via browser-based interfaces.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Detects instances where common package management utilities (pip, npm, wget, curl) establish network connections to domains outside of verified official package registry endpoints. This pattern is often used in software supply chain attacks to retrieve malicious packages from attacker-controlled infrastructure.
Detects the execution of known network exploitation tools like Responder.py or MultiRelay.py, as well as unauthorized processes binding to ports used for LLMNR (UDP 5355) and NBT-NS (UDP 137), which are classic indicators of potential adversary-in-the-middle attacks.
This rule detects Socket.IO WebSocket handshake attempts or Engine.IO connection openings targeting TCP port 1313. This pattern is commonly associated with administrative tools, backdoors, or command-and-control frameworks that utilize WebSocket communication over non-standard ports to bypass security controls.
This rule detects network connections to specific IP addresses and ports (1259, 1269) via UDP, or the presence of a file with a specific SHA256 hash. This combination could indicate command and control (C2) communication or data exfiltration using a custom UDP protocol.
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
Detects network communication associated with AsyncRAT command-and-control activity. The rule identifies established outbound connections on non-standard ports (6606, 7707, 8808) containing a specific 3-byte null sequence header, which is indicative of AsyncRAT's communication protocol.
Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.
This rule detects when a single account initiates 5 or more successful Remote Desktop Protocol (RDP) connections within a one-hour window. This behavior can be indicative of an adversary attempting to gain widespread access within a network, potentially through credential stuffing, brute-force attacks, or lateral movement using compromised credentials.
Detects the execution of potential malware disguised as 'winupdate.exe' and specific network traffic associated with it. The rule identifies suspicious file paths (e.g., in AppData cache) and execution by the binary while communicating with external domains such as pastebin.com or discord.com, which are often abused for command-and-control or payload delivery.
Page 89 of 246