Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
Detects anomalous outbound network connections initiated by powershell.exe occurring within 5 minutes of an inbound network connection on TCP port 1313, a pattern indicative of the exploitation of the Remote Mouse unauthenticated remote code execution (RCE) vulnerability and subsequent establishment of a reverse shell.
Detects an unauthenticated WebSocket or Socket.IO handshake attempt targeting the Peyara Remote Mouse service on TCP port 1313. This behavior is associated with the exploitation of known remote code execution vulnerabilities in the service.
This rule detects potentially malicious credential abuse patterns, such as credential stuffing or brute force attacks, originating from external IP addresses against edge appliance VPN or administrative interfaces. It identifies activity by correlating a high volume of failed authentication attempts followed by a successful login from the same external IP address.
Detects potential path traversal attempts in web server and gateway logs, specifically targeting URL parameters like 'url' or 'path'. The rule identifies suspicious URI sequences (e.g., dot-dot-slash) followed by large HTTP responses, which may indicate successful file retrieval or sensitive data access.
This rule detects anomalous spikes in inbound network connections to common edge device management ports (80, 443, 8080, 8443) by baselining the number of unique source IP addresses per destination over a 30-day window. It triggers an alert when the hourly count of unique source IPs deviates significantly (greater than 3 standard deviations) from the historical mean, which may indicate active network scanning or brute-force attempts.
Detects incoming network connections to Windows 'Nearby Share' process components from external (non-RFC1918) IP addresses. This activity is potentially malicious as legitimate 'Nearby Share' traffic should typically occur within local networks.
Detects incoming network connections to Windows 'Nearby Share' process components from external (non-RFC1918) IP addresses. This activity is potentially malicious as legitimate 'Nearby Share' traffic should typically occur within local networks.
Detects potential token manipulation attacks using SMB loopback connections. The rule identifies processes executing with privileges commonly associated with token impersonation (SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege) or running as SYSTEM that are not expected system processes, correlated with an SMB network connection to the local loopback address on port 445.
Detects anomalous SMB NTLM authentication traffic indicative of relay attacks, where an attacker intercepts an authentication request and relays it to another SMB service.
Detects multiple failed SSH authentication attempts against a server from a single source within a short timeframe, which is indicative of a brute force password attack.
Detects network traffic indicative of the EternalBlue (MS17-010) exploit attempt against SMBv1 services. The rule specifically looks for SMB packets with transaction command patterns associated with this exploit, which was commonly used by the WannaCry ransomware.
Detects repeated SSH connection attempts to a server over a short duration (10+ attempts in 60 seconds), which is characteristic of credential stuffing or brute-force password guessing attacks against the SSH service.
Detects multiple TCP connection attempts to port 22 (SSH) from the same source within a 60-second window, which is indicative of a brute-force or password guessing attack against SSH services.
Detects network traffic associated with PsExec lateral movement activity, specifically looking for the creation of the PSEXESVC named pipe over SMB/ADMIN$ shares, which is commonly used by PsExec to remotely execute services and commands on target systems.
Detects network traffic associated with PsExec lateral movement activity, specifically looking for the creation of the PSEXESVC named pipe over SMB/ADMIN$ shares, which is commonly used by PsExec to remotely execute services and commands on target systems.
Detects multiple failed SSH authentication attempts originating from a single source IP within a short timeframe, which is indicative of a brute-force or credential-stuffing attack against SSH services.
This rule detects the use of the PSEXESVC named pipe during a write operation over the SMB protocol, which is indicative of lateral movement using the PsExec tool.
Detects a high frequency of incoming TCP SYN packets targeting port 3389 (RDP) from a single source within a short time window. This behavior is indicative of a brute-force or credential-stuffing attack against Remote Desktop services.
This rule detects network traffic indicative of PsExec lateral movement, specifically identifying the authentication or access to the hidden 'ADMIN$' network share followed by the transfer or execution of the 'PSEXESVC' service binary, a hallmark of the PsExec tool.
Detects repeated SSH connection attempts to a server over a short duration (10+ attempts in 60 seconds), which is characteristic of credential stuffing or brute-force password guessing attacks against the SSH service.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Page 23 of 36