Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule identifies successful user sign-ins originating from IP addresses known to belong to VPN services. It leverages an external list of VPN IP ranges to correlate with Azure AD SigninLogs. This can indicate an attempt to bypass geo-restrictions, hide true origin, or could be legitimate use of a VPN by an employee.
Detects an abnormally high volume of connections to the hidden IPC$ administrative share on a Windows host within a short time window. This activity is often associated with lateral movement techniques, scanning, or brute-forcing attempts where adversaries interact with SMB shares for reconnaissance or remote execution.
Detects anomalous external scanning activity against internal web applications by monitoring for multiple requests to sensitive URI paths associated with vulnerability exploitation (e.g., cgi-bin, admin-ajax.php, .env, or command execution endpoints) originating from external IP addresses to internal network space.
Detects anomalous, high-volume API requests to ServiceNow endpoints originating from the same source IP that lack valid authorization headers or session tokens, potentially indicating automated scanning, enumeration, or exploitation attempts.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects HTTP response bodies containing common PE/Shellcode magic headers (MZ, PE, or NOP sleds) which are associated with the delivery of payloads designed to exploit or utilize the Windows KernelCallbackTable for process injection. The detection focuses on suspicious content delivered over HTTP connections.
Detects network traffic attempting to access sensitive Windows Registry keys (SAM, SECURITY, LSA Secrets, winlogon DefaultPassword) over the SMB protocol, which is indicative of credential harvesting activities.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Detects repeated inbound TCP connection attempts to port 3389 (RDP) from a single source address within a short timeframe. This behavior is indicative of an RDP brute-force or password spraying attack targeting remote desktop services.
This rule detects potentially malicious activity leveraging the Windows Remote Management (WinRM) protocol over HTTP (ports 5985/5986). It specifically monitors for POST requests to the '/wsman' URI that contain the string 'powershell' in the request body, which is indicative of remote command execution via WinRM using PowerShell.
Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.
Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
This rule detects potential lateral movement attempts using DCOM-based WMI calls to the remote OXID Resolver on port 135. Attackers often abuse DCOM to remotely trigger WMI methods, enabling remote code execution, discovery, or other malicious activities. The rule triggers on the characteristic DCOM OXID Resolve packet structure associated with this activity.
This rule detects unauthorized or unauthenticated WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. The detection looks for specific URL patterns characteristic of the Socket.IO protocol (EIO=4, transport=websocket) that indicate an attempt to establish a connection with the vulnerable service without proper credential exchange.
Detects suspicious HTTP requests and API activity targeting Fortinet devices, specifically matching patterns associated with known vulnerabilities like CVE-2022-40684 and CVE-2024-21762. The rule monitors for unauthorized REST API calls, attempts to interact with sensitive administrative endpoints, and patterns indicating potential authentication bypass or remote code execution attempts on FortiGate, FortiOS, and FortiProxy appliances.
This rule monitors network traffic for specific command-and-control (C2) communication patterns associated with the Ousaban banking trojan. It detects response packets from an external server to a client machine containing JSON-like structural indicators such as 'inicio{', 'host', and 'porta' followed by '}fim'.
Detects multiple failed SSH login attempts from a single source IP address, indicating a potential brute force attack. The rule identifies 'Invalid user' or 'Failed password' messages in syslog from the 'sshd' process and groups them by source IP and time to count unique attempted users and total attempts. A threshold of more than 5 attempted users from a single source IP within a 10-minute window triggers an alert.
Detects inbound RPC calls to the Server Service interface using operation number 12 (NetrSessionEnum), which may indicate remote session enumeration for account discovery and reconnaissance.
Detects an internet-facing host in the DMZ that receives an inbound connection from an external non-RFC1918 address and subsequently authenticates to an internal RFC1918 host within a one-hour window. This behavior is indicative of a compromised DMZ host being used as a pivot point for lateral movement into the internal network.
Page 21 of 36