Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
381 detections
Filters
Last updated
All Time
Detection languages
380
1
Contributors
160
79
64
38
20
Categories
220
190
146
124
101
Platforms
325
56
56
48
11
Products / Services
362
188
33
20
19
MITRE Techniques
140
73
56
53
51
CVEs
12
9
9
5
5
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
189
154
25
4
4
This rule detects network traffic destined for TCP port 902 on the home network, which is commonly used for ESXi vSphere management. The rule specifically looks for established TCP connections to this port and triggers an alert if five such connections are observed from the same source within a 30-second window. This could indicate management activity or potential reconnaissance/attack against ESXi hosts.
This rule detects network traffic indicative of a domain account being used for lateral movement via SMB. It specifically looks for NTLMSSP authentication within SMB traffic directed to port 445 on the home network, containing the string 'domain' (case-insensitive). A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, suggesting a potential brute-force or rapid access attempt.
This rule detects attempts to remotely install Windows services over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "svcctl" and "CreateService" in a case-insensitive manner, indicating a service control request to create a new service. This activity is often associated with adversaries establishing persistence on a compromised system.
This rule detects Kerberoasting activity, specifically looking for multiple Kerberos Ticket Granting Service (TGS) requests over UDP port 88 within a short timeframe from the same source IP. Kerberoasting is a post-exploitation technique used by attackers to obtain service principal name (SPN) hashes, which can then be cracked offline to retrieve the associated plaintext passwords. The rule uses a threshold of 20 TGS requests within 10 seconds from a single source to identify this suspicious behavior.
This rule detects attempts to manipulate the sudo timestamp cache by looking for repeated 'sudo -n' commands within a short timeframe. The 'sudo -n' command allows sudo to run a command without prompting for a password, which can be abused by an attacker to maintain sudo privileges or bypass re-authentication if they have already compromised a user's session. The thresholding mechanism (10 times in 30 seconds from the same source IP) aims to reduce false positives from legitimate, infrequent uses of 'sudo -n' and focus on potential automated or rapid attempts to interact with sudo without password prompts, possibly to keep the timestamp alive or to quickly execute multiple commands.
This rule detects the creation of a new Azure AD user account via the Microsoft Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing '/users'. This activity could indicate an attacker establishing persistence by creating new accounts in a compromised Azure AD environment.
This rule detects attempts to register a new device for MFA bypass persistence by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'authentication/methods'. This activity could indicate an attacker attempting to register their own device as a trusted device to bypass multi-factor authentication in an Office 365 environment.
This rule detects a brute-force attack against an SSH service on a network device management port. It triggers an alert if 15 or more TCP SYN packets are observed from a single source IP address to destination port 22 (SSH) within a 30-second window, indicating an attempt to establish multiple connections, characteristic of a brute-force attempt.
This rule detects attempts to create a new container service via the Docker API. It specifically looks for HTTP POST requests to the '/services/create' URI on port 2375, which is the default unencrypted Docker API port. This activity could indicate an attacker attempting to establish persistence or execute malicious containers on a compromised Docker host.
This rule detects attempts to modify hybrid identity federation settings by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'federationConfiguration'. This activity could indicate an attacker attempting to establish persistence or gain unauthorized access by manipulating identity federation.
This rule detects Kerberos Pass-the-Ticket attacks where a Ticket Granting Service (TGS) request contains a forged Privilege Attribute Certificate (PAC). This is identified by specific byte sequences in UDP traffic on port 88, which is commonly used for Kerberos.
This rule detects RDP access attempts from external IP addresses to the internal network ($HOME_NET) on port 3389. It uses a threshold of 3 connection attempts within 300 seconds from the same source IP to trigger an alert, indicating potential brute-force or reconnaissance activity targeting RDP services. The rule is classified under the MITRE ATT&CK technique T1133, which involves 'Remote Desktop Protocol' for initial access.
Remote AT Job Scheduled via SMB
Suricata
This rule detects attempts to schedule a remote AT job via SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive strings "atsvc" and "JobAdd". This combination indicates an attempt to use the AT service to add a scheduled task remotely, which can be a method for persistence or execution by attackers.
This rule detects attempts to access the command-line interface (CLI) of a network device via Telnet, specifically looking for the 'enable' and 'configure terminal' commands. This indicates an administrative attempt to configure or manage a network device.
This rule detects attempts to establish a TCP connection to port 902 on the home network, which is commonly used for VMware ESXi management. The rule specifically looks for SYN packets (flags:S) and triggers if there are at least 3 such connection attempts from the same source within a 60-second window. This could indicate an attempt to access or scan the ESXi management interface.
This rule detects attempts to deploy a container with host network mode enabled. It specifically looks for HTTP requests to the '/containers/create' endpoint, which is commonly used by container orchestration systems like Docker, and checks for the presence of 'host' within the HTTP client body, indicating the host network mode configuration. This can be a security concern as it allows the container to have direct access to the host's network interfaces, potentially bypassing network segmentation and security controls.
This rule detects attempts to execute commands within a Kubernetes pod using `kubectl exec`. It specifically looks for HTTP requests to port 8080 (often used by Kubernetes API servers or proxies) with URIs containing both '/exec' and 'pods', indicating an interactive command execution session within a pod.
This rule detects an attempt at RDP lateral movement by identifying multiple RDP connection attempts to a host within a short timeframe. It specifically looks for the RDP connection initiation sequence (hexadecimal content '|03 00 00|') on port 3389 (RDP default port) and triggers an alert if 5 such attempts are observed from the same source within 60 seconds. This behavior is indicative of an attacker trying to move laterally within a network using RDP.
This rule detects RDP login attempts from an external network to the internal network. It specifically looks for the RDP protocol header (0x03 0x00) on TCP port 3389. A threshold of 5 attempts within 60 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to access SNMP (Simple Network Management Protocol) services on the home network using the default community string 'public'. It specifically looks for the string 'public' within TCP traffic destined for port 161 (the standard SNMP port). A threshold of 5 attempts within 30 seconds from the same source IP will trigger an alert, indicating potential brute-force or reconnaissance activity against SNMP devices.
This rule detects a high volume of TCP SYN packets from an external IP address to the internal network, indicative of an attempted remote service access or port scan. Specifically, it triggers if 5 or more TCP SYN packets are observed from the same source IP within a 30-second window, targeting any port on the home network.
Page 13 of 19