Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
101 detections
Filters
Last updated
All Time
Detection languages
101
Contributors
36
24
19
13
6
Categories
45
34
24
23
23
Platforms
88
16
4
4
3
Products / Services
97
56
7
2
2
MITRE Techniques
39
25
17
17
14
CVEs
1
IDS Classtypes
1,937
503
461
381
236
101
IDS Protocols
43
41
8
3
2
This rule detects Address Resolution Protocol (ARP) spoofing attempts by looking for ARP reply packets (opcode 2) on the network. A threshold is applied to trigger an alert if 20 or more ARP replies are observed from the same source within a 10-second window, which is indicative of malicious ARP activity.
This rule detects ARP cache poisoning attempts by identifying multiple ARP responses (opcode 2) for the same IP address within a short time frame (15 responses in 5 seconds from the same source). This behavior is indicative of an attacker attempting to redirect network traffic by sending forged ARP replies.
This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (V4dC5FbmNvZ) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (dm9rZS1SZXN0TWV0) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (Zva2UtUmVzdE1ld) in DNS TXT Reponse
ET INFO DYNAMIC_DNS Query to a *.3trust .com domain
ET INFO DYNAMIC_DNS Query to a *.freeddns .me domain
ET INFO DYNAMIC_DNS Query to a *.anchorchain .co .za domain
ET INFO DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (2b2tlLVJlc3RNZX) in DNS TXT Reponse
This rule detects the presence of the 'Unregister-ScheduledTask' PowerShell cmdlet within the HTTP response body. This could indicate an attacker attempting to remove persistence mechanisms, specifically scheduled tasks, from a compromised system after initial compromise or during cleanup phases. The detection is case-insensitive and looks for the command along with optional parameters like '-taskname' or '-taskpath'.
This rule detects the presence of the 'schtasks /change' command within the HTTP response body. This could indicate an attacker modifying scheduled tasks on a compromised Windows system, potentially for persistence, privilege escalation, or lateral movement. The detection specifically looks for 'schtasks' and '/change' followed by '/tn' (task name) in a case-insensitive manner within HTTP responses with a 200 status code.
ET INFO DYNAMIC_DNS HTTP Request to a *.hornburst .com domain
ET INFO DYNAMIC_DNS Query to a *.hornburst .com domain
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (leHQuRW5jb2) in DNS TXT Reponse
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain
ET INFO DYNAMIC_DNS HTTP Request to a *.itafricagroup .com domain
ET INFO DYNAMIC_DNS HTTP Request to a *.3trust .com domain
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse
This rule detects the 'Stop-ScheduledTask' PowerShell cmdlet within the HTTP response body, indicating that a client on the internal network is receiving a command to stop a scheduled task. This could be part of an adversary's attempt to disable persistence mechanisms or disrupt system operations.
Page 4 of 5