Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
Tracks AAD/Exchange logs showing mail routed through an external tenant specifically to bypass internal domain spoofing filters via trusted connectors. This rule identifies emails where the sender's domain matches the internal company domain, but the email was routed through an external Office 365 connector and did not originate from a trusted internal IP address, indicating a potential cross-tenant spoofing attempt.
Detects NTP reflection amplification DDoS attack traffic
Detects unauthorized DHCP server responses indicating potential network compromise
Detects unauthorized DNS server responses used for infrastructure setup
Detects email bombing attacks via high-volume inbound email delivery
Detects when AI agent processes establish listening connections on network ports, indicating potential unauthorized service exposure or lateral movement activity.
Detects unauthorized DHCP server responses indicating potential network compromise
Detects python binding shell instances attempting to listen on ports 8000, 8001, or 8002 to act as a local proxy node.
Detects new unknown hardware MAC addresses appearing on the network
Identifies inbound remote RPC calls for network session enumeration (OpNum 12) via the srvsvc interface. This is often utilized by discovery tools like SharpHound for Active Directory reconnaissance.
This rule detects a VNC brute force login attempt. It triggers when there are 10 or more TCP connections to port 5900 (the default VNC port) from the same source IP address within a 30-second window, indicating a rapid succession of login attempts.
Detects unauthorized DNS server responses used for infrastructure setup
Identifies inbound remote RPC calls targeting the Remote Registry interface to save registry keys (OpNums 20 and 31). This is frequently abused for remote credential dumping of SAM/LSA secrets.
This rule detects attempts to manipulate access tokens via a remote SMB session. Specifically, it looks for the string "ImpersonateLoggedOnUser" within TCP traffic destined for port 445 (SMB). This activity could indicate an attacker attempting to elevate privileges or move laterally by impersonating a logged-on user.
This rule detects network traffic attempting to exploit a Service Registry ACL weakness remotely. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "HKLM\System\CurrentControlSet\Services" (case-insensitive) in the payload. This string is indicative of an attempt to modify or interact with Windows services via the registry, potentially leveraging weak ACLs to establish persistence or execute malicious code.
This rule detects NTP Reflection Amplification DDoS attacks by looking for specific content in UDP packets destined for the home network on port 123 (NTP). The rule triggers if 50 such packets are observed from the same destination within 5 seconds, indicating a high volume of NTP traffic potentially used for amplification.
This rule detects a potential DNS Reflection Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic targeting port 53 (DNS) on the home network has a data size greater than 512 bytes and occurs at a rate of 100 or more packets within a 5-second window from the same destination.
Detects rogue DHCP server used for credential interception via DNS spoofing
Direct TCP SYN Flood DoS Attack
Suricata
This rule detects a direct TCP SYN flood Denial of Service (DoS) attack. It triggers when a destination IP address receives 1000 or more TCP SYN packets within a 5-second window. The 'flags:S' indicates that only packets with the SYN flag set are counted. This type of attack aims to exhaust the target's resources by initiating many half-open connections.
Detects inbound RPC calls to the Server Service interface using operation number 12 (NetrSessionEnum), which may indicate remote session enumeration for account discovery and reconnaissance.
This rule detects attempts to grep for passwords within the bash history file over an SSH connection. Specifically, it looks for the string 'grep -i password ~/.bash_history' in TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker attempting to discover credentials on a compromised system.
Page 28 of 36