Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
381 detections
Filters
Last updated
All Time
Detection languages
380
1
Contributors
160
79
64
38
20
Categories
220
190
146
124
101
Platforms
325
56
56
48
11
Products / Services
362
188
33
20
19
MITRE Techniques
140
73
56
53
51
CVEs
12
9
9
5
5
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
189
154
25
4
4
This rule detects attempts to establish a WinRM HTTPS connection (port 5986) to a host on the home network. It specifically looks for TCP SYN packets (flags:S) and triggers if three such connection attempts are made from the same source within 60 seconds. This pattern can indicate lateral movement activity using WinRM over HTTPS.
This rule detects HTTP POST requests to 'management.azure.com' with a URI containing 'bastionHosts'. This pattern indicates an attempt to establish a direct VM connection via Azure Bastion, which could be used for lateral movement within an Azure environment.
This rule detects attempts to dump the LSASS process memory remotely over SMB. It specifically looks for network traffic on TCP port 445 (SMB) containing the string "lsass.dmp" in a case-insensitive manner, indicating a potential credential dumping activity.
This rule detects attempts to create a new local user account on a system via a remote Server Message Block (SMB) connection. It specifically looks for the string "NetUserAdd" (case-insensitive) within TCP traffic destined for port 445, which is commonly used by SMB. This activity is indicative of an attacker attempting to establish persistence or gain further access by creating new accounts.
This rule detects attempts to modify local or domain group memberships by monitoring TCP traffic on port 389 (LDAP). It specifically looks for the keywords "member" and "add" within the traffic, indicating an attempt to add a member to a group. A threshold of 5 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects the creation of a cluster role binding in a Kubernetes environment, specifically looking for HTTP POST requests to the Kubernetes API server's rbac.authorization.k8s.io endpoint for 'rolebindings'. This activity can indicate an attempt to establish persistence within the cluster by granting specific permissions to an identity.
This rule detects when an AWS IAM user policy is attached, specifically looking for the 'AttachUserPolicy' action on 'iam.amazonaws.com'. This could indicate an attempt to escalate privileges or grant new permissions to a compromised account.
This rule detects when a credential (password) is added to an Azure Service Principal. This activity is identified by monitoring HTTP traffic for requests to 'graph.microsoft.com' containing 'addPassword' in the URI. This could indicate an attacker establishing persistence by adding new credentials to an existing service principal.
This rule detects attempts to disable Conditional Access Policies in Microsoft 365 via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' targeting the 'conditionalAccess/policies' endpoint. Such activity could indicate an attacker attempting to bypass security controls for persistence or privilege escalation.
This rule detects attempts to modify or delete Multi-Factor Authentication (MFA) provider configurations via the Microsoft Graph API. Specifically, it looks for HTTP DELETE requests to 'graph.microsoft.com' with a URI containing 'authentication'. This activity could indicate an attacker attempting to disable or alter MFA settings to gain unauthorized access or maintain persistence.
This rule detects the creation of a Docker container via the Docker API (port 2375) where the container body content includes the string "cron" (case-insensitive). This could indicate an attempt to establish persistence or schedule malicious tasks within a Docker environment.
This rule detects HTTP POST requests to the GCP OS Login API endpoint 'oslogin.googleapis.com'. Such requests could indicate an attempt to execute commands on a Google Cloud instance using the OS Login feature, which is a common method for managing SSH access to instances.
This rule detects attempts to create a remote named pipe over SMB (Server Message Block) protocol. It specifically looks for TCP traffic directed to port 445 (SMB) on the home network, containing both the SMB signature (FF SMB) and the string "\pipe\" (case-insensitive), indicating an attempt to access or create a named pipe. This activity is often associated with inter-process communication, which can be leveraged by attackers for various purposes, including lateral movement, service execution, or privilege escalation.
This rule detects a high volume of Inter-Process Communication (IPC) activity targeting the RPC Endpoint Mapper on the home network. Specifically, it triggers an alert if more than 30 TCP connections to port 135 (RPC Endpoint Mapper) are observed from a single source IP within a 10-second window. This could indicate an attempt to enumerate services or exploit vulnerabilities related to RPC.
This rule detects potential cloud API access using a stolen token by monitoring HTTP requests to AWS S3, Azure management, or Google APIs that contain an 'Authorization: Bearer' header. A threshold of 50 such requests within 10 seconds from the same source IP triggers the alert, indicating a possible brute-force or high-volume access attempt with a compromised token.
This rule detects HTTP POST requests to common cloud console login pages (AWS, Microsoft Azure, Google Cloud) that originate from a suspicious IP range. The rule uses a threshold of 5 attempts within 30 seconds from the same source IP to trigger an alert, indicating potential brute-force or credential stuffing attacks against cloud accounts.
Remote LSASS Memory Dump via SMB
Suricata
This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.
This rule detects Telnet login attempts using the default credential 'admin'. It specifically looks for the string 'admin' (case-insensitive) in Telnet traffic flowing to the server. A threshold of 5 attempts within 60 seconds from the same source IP triggers the alert, indicating a potential brute-force or credential stuffing attack against Telnet services.
Remote AT Scheduled Job Creation
Suricata
This rule detects attempts to create scheduled jobs remotely using the 'atsvc' service, typically associated with the Windows Task Scheduler. It specifically looks for TCP traffic on port 445 (SMB) containing the string 'atsvc' in an established flow to the home network. This activity can be indicative of an adversary establishing persistence or executing code remotely.
This Suricata rule detects potential internal RDP session hijack attempts. It triggers an alert when there are three or more established TCP connections to port 3389 (RDP) on the home network, originating from within the home network, within a 30-second window, tracked by the destination IP address. This pattern could indicate an attacker attempting to take over an existing RDP session or rapidly establish multiple RDP connections internally.
This rule detects a potential RDP brute force attack by monitoring for a high number of TCP SYN packets directed to port 3389 (RDP) on the home network from a single source IP address within a short timeframe. Specifically, it triggers an alert if 10 or more SYN packets are observed from the same source within 60 seconds, indicating an attempt to establish multiple RDP connections, which is characteristic of a brute force attempt.
Page 17 of 19