Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
127 detections
Filters
Last updated
All Time
Detection languages
127
Contributors
93
34
Categories
52
48
20
19
15
Platforms
117
13
6
5
3
Products / Services
125
5
2
1
1
MITRE Techniques
29
29
22
16
15
IDS Classtypes
1,937
503
461
381
236
127
IDS Protocols
57
19
19
18
12
This rule detects DHCP requests originating from a MAC address that is not recognized or expected within the network. It uses a threshold to prevent excessive alerts from a single source, triggering if a source makes more than one DHCP request within a 5-second window. This could indicate an unauthorized device attempting to join the network or a spoofed MAC address.
This rule detects HTTP requests where the 'Host' header contains patterns indicative of free hosting services (000webhost, infinityfree, byethost). These services are often abused by attackers to host malicious infrastructure due to their low cost and ease of setup. The rule specifically looks for these patterns in HTTP traffic flowing from the home network to any destination.
This rule detects a pattern of bulk account registration attempts by monitoring HTTP POST requests to URIs containing 'register'. It triggers an alert if 10 such requests are observed from the same source IP within a 60-second window, indicating potential automated account creation or abuse.
This rule detects the installation of a new self-signed TLS certificate that might be used by a Command and Control (C2) server. It specifically looks for TLS certificates where both the issuer and subject Common Name (CN) are at least 5 alphanumeric characters long and the 'not before' date is in the current or future years (2024-2029). This combination of characteristics can indicate a newly generated, potentially malicious self-signed certificate.
Offshore VPS Provider API Access
Suricata
This rule detects HTTP traffic to specific domains associated with offshore VPS providers (frantech.ca, serverius.net, combahton.net). This could indicate API access or other interactions with these services, which might be suspicious depending on the environment.
This rule detects a possible port knocking sequence, which is a method of externally opening ports on a firewall by generating a sequence of connection attempts to a set of closed ports. The rule specifically looks for 5 TCP SYN packets from the same source IP within a 5-second window to any port on the home network, indicating a potential port knocking attempt.
This rule detects attempts to update system firmware from an unverified source. It specifically looks for HTTP traffic (flow:to_client,established) where the URI contains the string "firmware" (case-insensitive) and the file data contains the byte sequence "AA 55". This combination suggests a potential firmware update being delivered over HTTP, which could be malicious if the source is not legitimate.
This rule detects a TFTP (Trivial File Transfer Protocol) boot file request. Specifically, it looks for UDP traffic destined for port 69 (the standard TFTP port) on the home network, containing the byte sequence "|00 01|" at a depth of 2 bytes. This pattern is characteristic of a TFTP read request (opcode 1). The rule's message suggests this could indicate a possible bootkit delivery attempt, as TFTP is often used in network booting scenarios.
This rule detects a port knocking sequence on closed ports. It triggers an alert when four TCP SYN packets are observed from the same source IP address within a 5-second window, targeting any port on the home network. This behavior is indicative of an attacker attempting to perform port knocking to open a hidden port or service.
This rule detects bulk email account creation attempts on free email providers ProtonMail and Tutanota. It triggers when a client makes 3 or more HTTP requests within 60 seconds to the signup page of either protonmail.com or tutanota.com.
This rule detects when a TFTP (Trivial File Transfer Protocol) boot image is potentially pushed to a network device. It specifically looks for UDP traffic on port 69 (TFTP default port) directed to the home network, containing the byte sequence "|00 02|" (which often indicates a TFTP write request or a specific TFTP opcode) and having a data size greater than 10000 bytes, suggesting a large file transfer like a boot image.
This rule detects network connections to known vulnerability intelligence purchase platforms (zerodium.com, crowdfense.com, exodus.gl). These platforms are often used by threat actors to acquire zero-day exploits or other vulnerabilities. Accessing these sites could indicate an organization or individual is attempting to purchase or sell such intelligence, which can be a precursor to malicious activity or a violation of organizational policy.
This rule detects multiple TFTP (Trivial File Transfer Protocol) transfers to port 69 on the home network within a short timeframe. Specifically, it triggers an alert if three or more TFTP transfers from the same source IP address occur within a 30-second window. This activity can be indicative of a Pre-Boot Execution Environment (PXE) boot process, which often uses TFTP to transfer boot files, or potentially malicious activity involving file transfers via TFTP.
This rule detects when a third-party cloud application is authorized to access a Google account. It specifically looks for HTTP traffic to 'accounts.google.com' with a URI containing 'oauth2/auth' and 'scope', indicating an OAuth 2.0 authorization request. A threshold is set to trigger an alert if this activity occurs 3 times within 60 seconds from the same source IP address.
This rule detects potential AWS CLI API command execution by monitoring HTTP traffic for connections to 'amazonaws.com' and the presence of 'Action=' in the URI. It uses a threshold of 30 occurrences within 10 seconds from a single source IP to reduce false positives, indicating a high volume of API calls typical of automated scripts or tools.
This rule detects multiple attempts to pull container image manifests from public Docker registries (registry.hub.docker.com or ghcr.io). A threshold of 10 pulls within 60 seconds from the same source IP is set to identify potentially malicious or excessive activity, possibly indicating an attempt to enumerate or download numerous container images.
This rule detects SSH connections to the internal network ($HOME_NET) on port 22. It specifically looks for the 'SSH-2.0' content in the TCP flow to the server. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds. The rule's message suggests it's intended to identify third-party SSH access potentially using a vendor key, implying an attempt to detect unauthorized or unusual SSH activity.
This rule detects a Deauthentication (Deauth) attack pattern, specifically targeting forced Wi-Fi reconnections. It triggers an alert when a high volume (50 or more) of TCP SYN packets are observed from a single source IP address within a 5-second window directed towards the home network. This pattern is indicative of an attacker attempting to flood a Wi-Fi network with deauthentication frames, forcing legitimate clients to disconnect and then reconnect, which can be exploited for various malicious purposes like capturing handshakes or facilitating man-in-the-middle attacks.
This rule detects HTTP traffic where the host header or URI contains keywords associated with virtual machine software (virtualbox, vmware, qemu) and the URI also contains the word "create". This combination suggests the potential creation or interaction with virtual machines, which could be used for defense evasion by adversaries to hide malicious activity.
This rule detects attempts to modify an EC2 instance's attributes, specifically looking for the 'ModifyInstanceAttribute' API call to 'ec2.amazonaws.com'. This activity could indicate an attacker attempting to evade detection or alter the instance's configuration for malicious purposes.
This rule detects HTTP POST requests to cloud compute infrastructure management endpoints, specifically Amazon EC2, Google Cloud Compute, and Azure Management. The rule is triggered if 20 such requests are observed from a single source IP within 60 seconds, indicating potential automated activity to modify cloud infrastructure for evasion purposes.
Page 2 of 7