Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule detects network traffic containing the string "HKCU\\Software\\Classes\\CLSID" on TCP port 135 (DCE/RPC) directed towards the home network. This pattern is indicative of an attempt to modify registry keys related to COM objects, which can be used for persistence or privilege escalation by hijacking COM object execution.
This rule detects a potential network device authentication bypass attempt via SSH. Specifically, it looks for SSH traffic (port 22) directed to the home network that contains the strings "aaa authentication" and "none" (case-insensitive). This combination suggests a configuration where authentication, authorization, and accounting (AAA) is set to 'none', which could allow unauthorized access.
This rule detects RDP access attempts from external IP addresses to the internal network ($HOME_NET) on port 3389. It uses a threshold of 3 connection attempts within 300 seconds from the same source IP to trigger an alert, indicating potential brute-force or reconnaissance activity targeting RDP services. The rule is classified under the MITRE ATT&CK technique T1133, which involves 'Remote Desktop Protocol' for initial access.
This rule detects attempts to establish a TCP connection to port 902 on the home network, which is commonly used for VMware ESXi management. The rule specifically looks for SYN packets (flags:S) and triggers if there are at least 3 such connection attempts from the same source within a 60-second window. This could indicate an attempt to access or scan the ESXi management interface.
This rule detects executable attachments (e.g., .exe, .bat, .cmd, .scr, .pif, .com) being delivered via SMTP email. It specifically looks for these file extensions within the 'filename' attribute of email attachments.
This rule detects an attempt at RDP lateral movement by identifying multiple RDP connection attempts to a host within a short timeframe. It specifically looks for the RDP connection initiation sequence (hexadecimal content '|03 00 00|') on port 3389 (RDP default port) and triggers an alert if 5 such attempts are observed from the same source within 60 seconds. This behavior is indicative of an attacker trying to move laterally within a network using RDP.
This rule detects RDP login attempts from an external network to the internal network. It specifically looks for the RDP protocol header (0x03 0x00) on TCP port 3389. A threshold of 5 attempts within 60 seconds from the same source IP is set to reduce false positives.
This rule detects SSH connections to the internal network ($HOME_NET) on port 22. It specifically looks for the 'SSH-2.0' content in the TCP flow to the server. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds. The rule's message suggests it's intended to identify third-party SSH access potentially using a vendor key, implying an attempt to detect unauthorized or unusual SSH activity.
This rule detects a high volume of TCP SYN packets from an external IP address to the internal network, indicative of an attempted remote service access or port scan. Specifically, it triggers if 5 or more TCP SYN packets are observed from the same source IP within a 30-second window, targeting any port on the home network.
This rule detects attempts to enumerate domain group membership via LDAP queries. It specifically looks for TCP traffic to port 389 (LDAP) containing the string "(objectClass=group)" in a case-insensitive manner. A threshold is applied to trigger an alert if 10 such queries are observed from the same source within a 30-second window, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to enumerate network connection tables remotely over SMB (port 445). It specifically looks for the string "NetConnectionEnum" in TCP traffic directed to port 445 on the home network, indicating a potential network discovery activity.
This rule detects Telnet access attempts to network devices within the home network. It specifically looks for TCP traffic destined for port 23 (the standard Telnet port) and triggers an alert if three such connections from the same source IP are observed within a 60-second window. This activity is flagged as a 'possible compromise' due to Telnet's insecure nature and its common use in initial access or resource development by adversaries.
This rule detects potential rogue DNS server activity by monitoring UDP traffic on port 53 (DNS) to the home network. It specifically looks for DNS query responses (indicated by the content "|84 80|") and triggers an alert if 20 such responses are observed from the same source IP within a 30-second window. This behavior could indicate an unauthorized or malicious DNS server attempting to respond to client queries.
This rule detects TFTP (Trivial File Transfer Protocol) requests for bootloader files. Specifically, it looks for UDP traffic on port 69 (the standard TFTP port) where the packet content starts with the byte sequence "00 01". This pattern is characteristic of a TFTP read request for a file, often used in network booting scenarios to retrieve bootloader files. The rule flags this activity as a "Possible Pre-OS Persistence" mechanism, suggesting an adversary might be attempting to establish persistence before the operating system fully loads, potentially through techniques like bootkits or modifying boot records.
This rule detects an attempt to establish a VNC (Virtual Network Computing) connection from an external source to a host within the protected network. It specifically looks for TCP SYN packets (initial connection attempt) destined for common VNC ports (5900-5910) on the home network. This could indicate an attacker attempting to gain remote access to internal systems.
This rule detects attempts to perform a DNS zone transfer. It specifically looks for UDP traffic on port 53 (DNS) destined for the home network, containing the byte sequence "|00 FC|" at an offset of 2 bytes with a depth of 2 bytes. This byte sequence corresponds to the 'AXFR' (Authoritative Zone Transfer) query type in a DNS request, which is often used by attackers for reconnaissance to enumerate DNS records for a domain.
This rule detects attempts to establish a TCP connection to port 5985 on the home network, which is commonly used for WinRM (Windows Remote Management) over HTTP. The rule is configured to alert if three such connection attempts are made from the same source within a 60-second window, indicating potential lateral movement activity using WinRM.
This rule detects potential Kerberos authentication abuse related to cross-domain trusts. It specifically looks for TCP traffic on port 88 (Kerberos) to the home network, containing the byte '6b' at the first position of the payload. A threshold of 20 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating a potential brute-force or rapid authentication attempt.
This rule detects network traffic attempting to register an AppCert DLL in the Windows Registry for injection purposes. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive string "AppCertDlls". This activity is indicative of a persistence mechanism where a malicious DLL is configured to be loaded into processes, often for privilege escalation or code injection.
This rule detects attempts to overwrite critical system binaries (specifically executables in 'system32') via Server Message Block (SMB) protocol. It looks for SMB traffic to port 445, containing 'system32' and '.exe' (case-insensitive), with a payload size greater than 100,000 bytes, indicating a potential file transfer or modification of a large executable.
This rule detects multiple failed SSH login attempts using the username 'root' to a server on the home network. It triggers an alert if five such attempts occur within a 30-second window from the same source IP address. This behavior often indicates a brute-force attack targeting default credentials.
Page 30 of 36