Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.
This rule detects potential SMB Relay attacks attempting to capture NTLM hashes. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, where the flow is established and contains both "NTLMSSP" and "NTLMSSP_AUTH" content. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects a TCP SYN packet (initial connection attempt) directed towards port 10443 on the home network. The message indicates this is a probe targeting a Palo Alto Firewall Management Interface. This suggests an attempt to discover or interact with a Palo Alto firewall's management interface, potentially for reconnaissance or exploitation.
This rule detects a high volume of inbound emails to port 25 (SMTP), indicating a potential email bombing attack. It triggers an alert if more than 100 emails are received from a single source IP address within a 60-second window.
This rule detects potential internal SSH lateral movement attempts. It triggers an alert when there are 5 or more TCP SYN packets (indicating connection attempts) to port 22 (SSH) within a 60-second window, originating from a host within the home network and targeting another host within the home network. This threshold-based detection aims to identify rapid, repeated SSH connection attempts that could signify an attacker trying to move between internal systems.
This rule detects the creation of a new user account on a Windows system via SMB (port 445) where the account name contains 'svc_' and the 'NetUserAdd' function is used. This could indicate an attacker creating a service account with a name that mimics legitimate system accounts to evade detection.
This rule detects a replication request to a Domain Controller (DC) containing the string "DsGetNCChanges" over TCP port 389 (LDAP). This specific string is associated with Active Directory replication. The rule is designed to identify potential rogue Domain Controllers attempting to replicate with legitimate DCs, which could indicate an attacker trying to establish a malicious DC for credential harvesting or other attacks. A threshold of 3 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects a rogue DHCP server offer on the network. It specifically looks for UDP traffic on port 67 (DHCP server port) to the home network, containing the DHCP message type '02' (DHCP Offer) at the beginning of the payload. A threshold is set to trigger an alert if 3 such offers are detected from the same source within 10 seconds, indicating a potentially malicious or misconfigured DHCP server attempting to assign IP addresses.
Detects NTP reflection amplification DDoS attack traffic
This rule detects remote activation of COM objects via DCOM (Distributed Component Object Model) on TCP port 135. It specifically looks for the byte sequence '|05 00 0b|' and the string 'IDispatch' within the network flow, indicating an attempt to interact with COM objects remotely. This activity can be associated with lateral movement or execution techniques by attackers.
This rule detects attempts to access the Docker TLS API on port 2376. It triggers an alert if there are 5 or more TCP SYN packets (indicating connection attempts) from a single source to the Docker TLS API port within a 60-second window. This could indicate an attacker attempting to gain unauthorized access or control over Docker containers.
This rule detects attempts to establish a VNC (Virtual Network Computing) remote desktop session to a host on the protected network. It specifically looks for TCP traffic destined for port 5900 (the default VNC port) and the presence of the 'RFB 00' string within the initial bytes of the connection, which is characteristic of the VNC RFB (Remote Framebuffer) protocol handshake.
This rule detects attempts to query Windows Firewall status remotely over TCP port 445 (SMB). The detection is based on the presence of the case-insensitive string "FirewallProduct" in the network flow, indicating a potential query for firewall product information. This activity could be part of a reconnaissance phase by an attacker to understand the target's security posture.
This rule detects the upload of a vSphere Installation Bundle (VIB) to an ESXi host. It specifically looks for HTTP PUT requests to the '/bundle' URI with a payload size greater than 100,000 bytes, which is indicative of a VIB file transfer. This activity could be part of a persistence mechanism where an attacker installs malicious software or backdoors on an ESXi host.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive string "Print Processors". This pattern is indicative of an attempt to register a malicious Print Processor DLL for persistence, a technique used by adversaries to maintain access to a system. The rule specifically looks for traffic flowing to the home network, suggesting an inbound attempt to establish persistence.
This rule detects network traffic to port 445 (SMB) containing the case-insensitive string "Authentication Packages". This string is often associated with the registration of malicious authentication package DLLs via the Windows Registry, a technique used for persistence and credential access. The rule specifically looks for this content in established TCP connections flowing to the home network.
This rule detects attempts to push firmware or bootkit images to a device via a remote SSH session. It specifically looks for the commands 'dd if=' and '/dev/' within TCP traffic directed to port 22 (SSH), indicating an attempt to write data directly to a device file, which is a common method for flashing firmware or installing bootkits.
This rule detects network traffic destined for TCP port 902 on the home network, which is commonly used for ESXi vSphere management. The rule specifically looks for established TCP connections to this port and triggers an alert if five such connections are observed from the same source within a 30-second window. This could indicate management activity or potential reconnaissance/attack against ESXi hosts.
This rule detects NTP amplification DDoS attacks by looking for UDP traffic on port 123 (NTP) with a specific content signature ('|17 00 03 2a|') and a high threshold of 50 packets within 5 seconds from the same destination. This pattern is indicative of an NTP monlist request, which can be abused for amplification attacks.
Detects remote service connections originating from external internet addresses
This rule detects a TFTP (Trivial File Transfer Protocol) boot file request. Specifically, it looks for UDP traffic destined for port 69 (the standard TFTP port) on the home network, containing the byte sequence "|00 01|" at a depth of 2 bytes. This pattern is characteristic of a TFTP read request (opcode 1). The rule's message suggests this could indicate a possible bootkit delivery attempt, as TFTP is often used in network booting scenarios.
Page 29 of 36