Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
127 detections
Filters
Last updated
All Time
Detection languages
127
Contributors
93
34
Categories
52
48
20
19
15
Platforms
117
13
6
5
3
Products / Services
125
5
2
1
1
MITRE Techniques
29
29
22
16
15
IDS Classtypes
1,937
503
461
381
236
127
IDS Protocols
57
19
19
18
12
This rule detects DNS queries to known dynamic DNS providers, which can be indicative of Command and Control (C2) infrastructure. Adversaries often use dynamic DNS services to maintain persistent access to compromised systems, as the IP addresses of their C2 servers may change frequently. The rule specifically looks for queries containing domains like duckdns.org, no-ip.com, ddns.net, hopto.org, zapto.org, and sytes.net.
This rule detects HTTP POST requests to known paste sites (pastebin.com, paste.ee, hastebin.com) with a data size greater than 500 bytes. This behavior is often associated with adversaries using these sites to host malicious payloads or exfiltrate data.
This rule detects HTTP traffic where the URI contains both "firmware" and "update" (case-insensitive) and the HTTP host is an IP address. This combination suggests a firmware update request originating from or destined for an unverified source, potentially indicating a malicious or unauthorized firmware update attempt.
This rule detects a pattern indicative of a rogue network device performing keyboard injection. It specifically looks for the case-insensitive string "HID" (Human Interface Device) within TCP traffic flowing from a client to a server, with a threshold of 3 occurrences within 5 seconds from the same source. This behavior is often associated with devices like USB Rubber Ducky or similar tools used for automated keystroke injection.
This rule detects attempts to create new accounts on major cloud platforms (AWS, Azure, Google Cloud) by monitoring HTTP traffic for specific hostnames and the 'signup' keyword in the URI. It specifically looks for connections to 'aws.amazon.com', 'portal.azure.com', or 'console.cloud.google' with 'signup' in the URI, indicating a potential account creation activity.
This rule detects HTTP requests made to well-known AI service API endpoints (OpenAI, Anthropic, Google Generative Language) specifically targeting 'completions' functionality. It triggers an alert if a single source IP makes more than 30 such requests within a 60-second window, indicating potential automated or high-volume use of AI tools for content generation, which could be leveraged for attack content.
This rule detects internal network traffic to port 3128, which is commonly used by Squid proxy servers. The rule is specifically looking for a high volume of such connections (10 connections within 60 seconds from the same source IP) within the home network, suggesting the use of a Squid proxy for internal command and control (C2) routing. The 'flow:to_server,established' indicates that the rule triggers on established connections from a client within the home network to a server within the home network on port 3128.
This rule detects a rogue DHCP server offer on the network. It specifically looks for UDP traffic on port 67 (DHCP server port) to the home network, containing the DHCP message type '02' (DHCP Offer) at the beginning of the payload. A threshold is set to trigger an alert if 3 such offers are detected from the same source within 10 seconds, indicating a potentially malicious or misconfigured DHCP server attempting to assign IP addresses.
This rule detects HTTP POST requests to the Google Cloud Platform (GCP) Compute Engine API (compute.googleapis.com). It specifically looks for a high volume of these requests (20 within 10 seconds from the same source IP), which could indicate automated activity or potential command execution attempts within GCP. The rule is designed to identify suspicious interactions with the GCP API that might be related to execution tactics.
This rule detects attempts to fetch Python package files (setup.py or __init__.py) from pypi.org over HTTP. This activity could indicate a client attempting to download or interact with Python packages, potentially including malicious ones, from the Python Package Index. The rule uses a threshold to alert on frequent occurrences from the same source.
This rule detects attempts to pull a Docker image via an unauthenticated Docker API. Specifically, it looks for HTTP requests to the '/images/create' endpoint on port 2375, which is the default unauthenticated Docker API port. This activity could indicate an attacker exploiting an exposed Docker daemon to deploy malicious images or gain further access to the host system.
This rule detects HTTP requests to domains associated with free SSL certificate issuance (Let's Encrypt or ZeroSSL) where the URI contains 'acme'. This could indicate an attacker attempting to obtain a free SSL certificate for a domain they control, potentially for use in phishing or other malicious activities. The rule uses a threshold to prevent excessive alerts from legitimate certificate renewals.
This rule detects the use of a suspicious wildcard certificate in the TLS handshake where the certificate subject contains a wildcard character followed by a domain name with a specific pattern (6 to 12 alphanumeric characters) and a top-level domain (TLD) from a list associated with malicious activities (xyz, top, club, icu). This pattern is often observed in attack infrastructure, particularly for phishing or command and control (C2) servers, to make them appear more legitimate or to facilitate rapid domain generation. The rule specifically looks for '*.domain.tld' where 'domain' is 6-12 chars and 'tld' is one of the specified suspicious TLDs.
This rule detects HTTP connections to known paid intelligence databases. It specifically looks for hostnames containing 'silobreaker.com', 'sixgill.io', or 'cybersixgill' in HTTP traffic flowing from the home network to any destination. This could indicate an internal system or user accessing external threat intelligence platforms, which might be a normal operation for security teams but could also be an indicator of reconnaissance activity by an adversary.
This rule detects HTTP access to domains or hosts associated with bulletproof hosting infrastructure. It specifically looks for hostnames containing '.ru/', '.cn/', 'frantech', 'serverius', or 'combahton'. A threshold of 5 occurrences within 60 seconds from the same source IP triggers the alert.
This rule detects when a network device configuration is transferred via TFTP. It specifically looks for UDP traffic on port 69 (TFTP's default port) and checks for the byte sequence "|00 02|" at the beginning of the payload, which corresponds to a TFTP read request (opcode 2). This activity is often associated with attackers collecting configuration files from network devices.
This rule detects attempts to establish a raw socket connection that is not TCP, UDP, or ICMP. This behavior can be indicative of a socket filter backdoor, where an attacker uses raw sockets to bypass standard network stack processing and potentially sniff or inject arbitrary network traffic. The rule specifically looks for outgoing connections from the home network to any destination where the IP protocol is not 6 (TCP), 17 (UDP), or 1 (ICMP).
This rule detects HTTP POST requests to Amazon Web Services (AWS) endpoints that are associated with non-standard or less common cloud regions. Specifically, it looks for 'amazonaws.com' in the HTTP host and then checks the HTTP URI for region codes 'ap-east' (Asia Pacific - Hong Kong), 'me-south' (Middle East - Bahrain), or 'af-south' (Africa - Cape Town). The detection is triggered when a resource creation (indicated by HTTP POST) is attempted in one of these regions, which might be unusual for an organization primarily operating in other regions, potentially indicating unauthorized activity or misconfiguration.
This rule detects when a bootloader file is delivered via HTTP. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'bootloader', 'grub', 'bootmgr', or 'mbr' (case-insensitive) and the file data contains the magic bytes '|55 AA|', which often indicate the end of a boot sector or a master boot record.
This rule detects potential rogue DHCP servers on a wireless segment by looking for UDP traffic on port 67 (DHCP server port) with a specific DHCP message type (likely a DHCP offer or acknowledgement, indicated by '|02|' at offset 0). It uses a thresholding mechanism to trigger an alert if 3 such packets are observed from the same source within 10 seconds, which helps to reduce false positives from single, isolated packets.
This rule detects network connections from devices that might be Raspberry Pis or Hak5 devices, based on their HTTP User-Agent string. Specifically, it looks for User-Agents containing 'python-requests' or 'curl/' followed by a digit, indicating the use of common command-line tools or Python libraries for making HTTP requests. The rule is configured to trigger an alert if 10 such connections are observed from the same source IP within 10 seconds, suggesting automated or frequent activity.
Page 1 of 7