Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
381 detections
Filters
Last updated
All Time
Detection languages
380
1
Contributors
160
79
64
38
20
Categories
220
190
146
124
101
Platforms
325
56
56
48
11
Products / Services
362
188
33
20
19
MITRE Techniques
140
73
56
53
51
CVEs
12
9
9
5
5
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
189
154
25
4
4
This rule detects HTTP traffic directed to 'management.azure.com' with a URI containing 'runCommand'. This pattern indicates an attempt to execute a command on an Azure Virtual Machine using the Azure Run Command feature. This activity is often associated with administrative actions or potential malicious execution on cloud resources.
This rule detects when an AWS Systems Manager (SSM) Run Command is executed on an EC2 instance. It specifically looks for HTTP traffic to 'ssm.amazonaws.com' with the URI containing 'SendCommand'. This indicates an attempt to remotely execute commands on an EC2 instance via AWS SSM.
This rule detects the remote installation of a new systemd service unit. It specifically looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "/etc/systemd/system/" and ".service" (case-insensitive). This combination suggests that a new systemd service file is being transferred or created remotely, which could indicate an attacker establishing persistence or escalating privileges.
This rule detects attempts to access named pipes via Server Message Block (SMB) on port 445. It specifically looks for the SMB signature and the 'IPC$' string within the traffic, indicating an attempt to establish an Inter-Process Communication (IPC) connection. A threshold is set to trigger an alert if 10 such events occur from the same source within 30 seconds, which could indicate enumeration or exploitation attempts.
This rule detects an anomaly in Kerberos authentication attempts by monitoring TCP traffic to port 88 (Kerberos). It triggers an alert if a source IP address attempts Kerberos authentication 30 or more times within a 10-second window, indicating a potential brute-force or rapid authentication attempt against a domain account.
This rule detects multiple failed SSH login attempts using the username 'root' to a server on the home network. It triggers an alert if five such attempts occur within a 30-second window from the same source IP address. This behavior often indicates a brute-force attack targeting default credentials.
This rule detects attempts to log in to a web interface using default 'admin' credentials. It specifically looks for HTTP POST requests to a URI containing 'login' and a client body that contains 'admin' twice, indicating both username and password might be 'admin'.
This rule detects Server Message Block (SMB) access attempts from external sources to internal networks, specifically looking for NTLMSSP (NT LAN Manager Security Support Provider) authentication traffic. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This could indicate an attempt by a third-party vendor or an attacker to access internal resources via SMB.
This rule detects potential RDP session hijacking attempts by looking for the string "tscon" within TCP traffic destined for port 3389 (RDP). The 'tscon' command can be used to connect to or take control of another user's RDP session.
This rule detects internal lateral movement attempts within a network using remote services. It specifically looks for TCP traffic originating from and destined to the home network, indicating internal communication. A threshold of 10 connections within 30 seconds from the same source IP is used to identify suspicious activity, suggesting a potential brute-force or rapid connection attempt indicative of lateral movement.
This rule detects the potential use of a stolen web session cookie from a new location. It specifically looks for HTTP traffic containing common session-related keywords like 'session', 'auth', or 'token' within the HTTP cookie header. A threshold of 10 occurrences within 5 seconds, tracked by destination IP, is used to trigger the alert, indicating a potential high-frequency attempt to use a session cookie.
This rule detects unauthorized Kerberos service ticket requests directed at a Domain Controller (DC). It specifically looks for TCP traffic to port 88 (Kerberos) on the home network, with a content match for the byte sequence '|6b|' at the beginning of the payload. A threshold of 50 requests within 10 seconds from the same source IP triggers the alert, indicating a potential brute-force or enumeration attempt against Kerberos services.
This rule detects potential credential stuffing attacks by identifying HTTP requests to login pages that use user agents commonly associated with automated tools like 'python-requests', 'Go-http-client', or 'curl'. It triggers if 20 such requests are observed from the same source IP within 30 seconds, indicating a high volume automated attempt.
This rule detects attempts to execute commands via an unauthenticated Docker API. Specifically, it looks for HTTP POST requests to the '/exec' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker daemon access. This could indicate an attacker attempting to gain control or execute arbitrary commands within Docker containers or the host system.
This Suricata rule detects Kerberos unconstrained delegation abuse by looking for a specific byte sequence in UDP traffic destined for port 88 (Kerberos). The byte sequence '|a0 03 02 01 05 a1 03 02 01 0d|' is indicative of a specific Kerberos message structure that can be associated with unconstrained delegation. Unconstrained delegation allows a service to impersonate any user to any other service on the network, which can be abused by attackers for privilege escalation and lateral movement.
This rule detects attempts to modify Group Policy Objects (GPOs) over Server Message Block (SMB) by looking for HTTP PUT requests containing '\SYSVOL\' and '\Policies\' in the URI. This activity can indicate an adversary attempting to escalate privileges or establish persistence within an Active Directory domain.
This rule detects an attempt to establish a VNC (Virtual Network Computing) connection from an external source to a host within the protected network. It specifically looks for TCP SYN packets (initial connection attempt) destined for common VNC ports (5900-5910) on the home network. This could indicate an attacker attempting to gain remote access to internal systems.
This rule detects attempts to create new user accounts via SMB (Server Message Block) by looking for the 'NetUserAdd' function call within SMB traffic. This could indicate an attacker attempting to establish persistence or escalate privileges by creating new accounts on a target system.
This rule detects attempts to execute remote services over SMB, specifically looking for traffic on port 445 containing both the SMB signature and the 'Service Control' string. This combination suggests an attempt to interact with or manipulate services on a remote system via SMB, which is a common technique used by attackers for lateral movement or privilege escalation.
This rule detects potential NTLM Relay attacks over SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, and within that traffic, it identifies the presence of both the SMB protocol signature ('|FF|SMB') and the NTLMSSP (NTLM Security Support Provider) signature. This combination suggests an attempt to relay NTLM authentication.
This rule detects an FTP brute force attempt by monitoring TCP connections to port 21 (FTP) on the home network. It triggers an alert if 20 or more TCP SYN packets (indicating new connection attempts) are observed from the same source IP address within a 60-second window. This behavior is indicative of an attacker repeatedly trying to guess FTP credentials.
Page 15 of 19