Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
This rule detects HTTP PUT requests to s3.amazonaws.com that include the 'x-amz-copy-source' header and have a data size greater than 1000 bytes. This combination of indicators suggests an attempt to copy data from one S3 bucket to another, potentially indicating data exfiltration to an attacker-controlled AWS account.
This rule detects attempts to replace cryptocurrency wallet addresses within HTTP POST requests. It specifically looks for patterns matching Bitcoin (P2PKH, P2SH, Bech32) and Ethereum (0x) wallet addresses in the client body of HTTP POST requests. This activity is indicative of clipboard hijacking or similar malware that aims to redirect cryptocurrency transactions to an attacker's wallet.
This rule detects potential tampering with financial transaction data during transit. It specifically looks for TCP traffic flowing to a server, where the data size is between 100 and 500 bytes, and the content contains both "amount" and "transfer" (case-insensitive). This combination suggests an attempt to modify financial transaction details.
This rule detects bulk data access from an internal information repository. It triggers when a single source IP address performs 50 or more HTTP GET requests within a 30-second window to any destination. This behavior could indicate an attempt to exfiltrate or rapidly collect large amounts of data from internal web-based resources.
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects HTTP POST requests that contain data resembling a ZIP archive (indicated by 'PK' header) and have a size greater than 50,000 bytes. This pattern is often associated with data exfiltration where collected data is archived before being sent out of the network.
This rule detects a high volume of HTTP GET requests to Azure Blob Storage, specifically targeting '.blob.core.windows.net' domains. A threshold of 50 requests within 60 seconds from a single source IP address triggers the alert, indicating a potential bulk data download activity. This could be indicative of data exfiltration or unauthorized access to cloud storage.
This rule detects a high volume of HTTP GET requests to AWS S3 buckets from a single source IP address within a short timeframe. Specifically, it triggers if more than 50 GET requests are observed within 60 seconds to hosts matching 's3.amazonaws.com' or '.s3.' patterns. This behavior can indicate an attempt to exfiltrate data or perform bulk collection from an S3 bucket.
This rule detects attempts to copy SSL private key files over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings ".key" and "private" (case-insensitive) in the data being sent to the server. This activity could indicate an attacker attempting to exfiltrate sensitive cryptographic material.
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
This rule detects potential data exfiltration to Google Drive by monitoring HTTP POST requests to 'www.googleapis.com' with a data size greater than 5000 bytes. This pattern is indicative of large data uploads to Google's API services, which could be used for exfiltration.
This rule detects potential DLL injection attempts over HTTP by looking for the presence of both 'LoadLibraryA' and 'VirtualAllocEx' within the file data of an HTTP response. These functions are commonly used in conjunction during DLL injection techniques, where 'VirtualAllocEx' allocates memory in a remote process and 'LoadLibraryA' loads a DLL into that allocated memory. The 'flow:to_client,established' indicates that the detection is looking for these patterns in data flowing from the server to the client over an established HTTP connection.
This rule detects the delivery of shellcode designed to hijack the KernelCallbackTable. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "KernelCallbackTable" and "NtUserSetWindowsHookEx" (case-insensitive) within the file data. This technique is often used for privilege escalation or persistence by redirecting kernel callbacks to malicious code.
This rule detects TFTP (Trivial File Transfer Protocol) traffic on UDP port 69, specifically looking for a content pattern that indicates a firmware push. The pattern '|00 02|' at the beginning of the UDP payload suggests a TFTP write request (opcode 2), which is commonly used for uploading files, including firmware, to network devices. The rule is designed to alert on such activity directed towards the local network ($HOME_NET).
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
This rule detects attempts to drop executable files (.exe) into shared network folders (specifically those containing '\share\') over SMB (Server Message Block) protocol. This activity is indicative of an attacker attempting to move tools or malware laterally within a network.
This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 5000 bytes, indicating a significant upload.
This rule detects large HTTP POST requests originating from the internal network ($HOME_NET) to any external destination. It specifically looks for HTTP POST methods and a data size greater than 10,000 bytes. A detection filter is applied to track by source IP, triggering an alert if 20 such large POST requests are observed within a 60-second window. This behavior is indicative of potential data exfiltration over command and control (C2) channels, as large amounts of data are being sent out of the network.
This rule detects HTTP PUT requests to onedrive.live.com with a body size greater than 5000 bytes. This behavior is indicative of data exfiltration to OneDrive cloud storage, aligning with MITRE ATT&CK technique T1567.
This rule detects potential data exfiltration attempts via Microsoft Teams webhook connectors. It specifically looks for HTTP POST requests to 'outlook.office.com' with a URI containing '/webhook/' and a data size greater than 500 bytes. This combination suggests that data might be sent out through a Teams webhook, which can be abused for exfiltration.
This rule detects attempts to enumerate application windows using specific API calls (EnumWindows and GetWindowText) over HTTP. This behavior is often associated with remote access tools or malware trying to gather information about the user's active applications.
Page 23 of 26