Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule detects a high volume of Inter-Process Communication (IPC) activity targeting the RPC Endpoint Mapper on the home network. Specifically, it triggers an alert if more than 30 TCP connections to port 135 (RPC Endpoint Mapper) are observed from a single source IP within a 10-second window. This could indicate an attempt to enumerate services or exploit vulnerabilities related to RPC.
This rule detects VNC (Virtual Network Computing) remote access sessions initiated from any source IP address to any IP address within the local network ($HOME_NET) on port 5900. It specifically looks for the 'RFB 00' string within the first 7 bytes of the TCP payload, which is characteristic of the VNC protocol handshake. A threshold is applied to trigger an alert if 3 such connections are observed from the same source IP within a 60-second window, indicating potential repeated or sustained VNC activity.
This rule detects potential DNS hijacking attempts via a compromised resolver. It specifically looks for UDP traffic on port 53 (DNS) to the home network, containing the DNS response code '81 80' (indicating a standard query response) and the PCRE pattern '/\x00\x01\x00\x00/' which corresponds to a single question in the DNS query. A threshold of 20 occurrences within 10 seconds from the same source IP triggers the alert, suggesting a high volume of suspicious DNS responses.
This rule detects WHOIS queries directed to internal services within the network. It specifically looks for TCP traffic on port 43 (the standard WHOIS port) flowing from any source to the internal network. A threshold of 5 queries within 60 seconds from the same source is set to reduce noise, indicating a potential network scan or reconnaissance activity.
Remote LSASS Memory Dump via SMB
Suricata
This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.
This rule detects Wake-on-LAN (WoL) magic packets. WoL is a network standard that allows a computer to be turned on or woken up by a network message. While legitimate, adversaries can use WoL to activate compromised systems (implants) for command and control or other malicious activities, especially if the system was previously shut down to evade detection.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects inbound network connections from external, non-private IP addresses to local ports 6081 and 6082. These ports are used by the PAN-OS User-ID Authentication Portal, which is actively targeted by CVE-2026-0300.
Detects inbound network connections from external, non-private IP addresses to local ports 6081 and 6082. These ports are used by the PAN-OS User-ID Authentication Portal, which is actively targeted by CVE-2026-0300.
Identifies network connections targeting port 6082, commonly used by the PAN-OS User-ID portal and specifically targeted in the CVE-2026-0300 PoC exploit to deliver a buffer overflow payload.
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
Detects multiple failed SSH login attempts from a single source IP address, indicating a potential brute force attack. The rule identifies 'Invalid user' or 'Failed password' messages in syslog from the 'sshd' process and groups them by source IP and time to count unique attempted users and total attempts. A threshold of more than 5 attempted users from a single source IP within a 10-minute window triggers an alert.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
This rule detects inbound network connections to Active Directory Web Services (ADWS) on port 9389, followed by either LDAP query events (Event ID 1644) or operations on Active Directory objects (Event ID 4662) originating from the same device. This combination of events can indicate reconnaissance or malicious activity targeting Active Directory, such as attempts to enumerate accounts or groups, or to modify AD objects.
This rule detects inbound SSH connections originating from external IP addresses to systems running SSH services. It specifically looks for successful incoming network connections where the destination port is commonly associated with SSH (22, 222, 2222, 8022) or the source process name is an SSH daemon (sshd, dropbear). The rule explicitly excludes connections from private IP ranges and certain common web server processes on standard web ports to reduce false positives. The threat model includes unauthorized external SSH access, brute-force/credential-stuffing attacks, backdoor SSH daemons, compromised servers accepting attacker sessions, and reverse shell callbacks.
Detects network traffic on TCP port 18789, the default gateway port for OpenClaw. Monitoring for unauthorized external access to this port helps identify exposed admin dashboards or exploitation.
This alert generates a log when a device onboarded is seen connecting to a known malicious domain within the ThreatIntelIndicators table. The TimeGenerated field should not be changed as the table refreshes every ~10 days.
Page 32 of 36