Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
127 detections
Filters
Last updated
All Time
Detection languages
127
Contributors
93
34
Categories
52
48
20
19
15
Platforms
117
13
6
5
3
Products / Services
125
5
2
1
1
MITRE Techniques
29
29
22
16
15
IDS Classtypes
1,937
503
461
381
236
127
IDS Protocols
57
19
19
18
12
This rule detects HTTP requests where the 'Host' header matches patterns commonly associated with serverless function domains, specifically AWS Lambda URLs, Azure Websites, and Google Cloud Functions. The rule is designed to identify potential command and control (C2) infrastructure utilizing serverless platforms. It triggers an alert if 10 such requests are observed from a single source IP within a 60-second window.
This rule detects HTTP traffic where the 'Host' header contains 'workers.dev'. This domain is associated with Cloudflare Workers, which can be used by attackers to deploy attack infrastructure such as command and control (C2) servers, phishing pages, or data exfiltration points. The rule is configured to trigger a threshold alert if 10 such connections are observed from a single source IP within 60 seconds, indicating potential automated activity or repeated attempts to access or deploy malicious worker scripts.
This rule detects attempts to create or access disposable email accounts by monitoring HTTP traffic for specific keywords in the HTTP host header. It triggers an alert if it observes 5 instances of these keywords from the same source IP within a 60-second window. The keywords include common disposable email service domains like 'guerrillamail', 'tempmail', 'mailinator', and '10minutemail'.
This rule detects the use of self-signed TLS certificates on newly registered domains, specifically those ending in .xyz, .top, .club, .online, or .site. It looks for certificates where both the issuer and subject Common Name (CN) fields are present, and the subject CN matches a pattern indicative of a newly registered domain (5 to 20 alphanumeric characters followed by one of the specified TLDs). This pattern is often associated with malicious infrastructure setup.
This rule detects potential rogue DNS server activity by monitoring UDP traffic on port 53 (DNS) to the home network. It specifically looks for DNS query responses (indicated by the content "|84 80|") and triggers an alert if 20 such responses are observed from the same source IP within a 30-second window. This behavior could indicate an unauthorized or malicious DNS server attempting to respond to client queries.
This rule detects HTTP network connections to common Cloud Virtual Private Server (VPS) providers (DigitalOcean, Vultr, Linode, Hetzner) where the URI content includes the word 'create'. This combination suggests an attempt to set up new infrastructure, potentially for malicious purposes, aligning with resource development tactics.
This rule detects network connections to known threat intelligence vendor portals. It specifically looks for HTTP traffic where the host header matches one of the specified domains: intel471.com, ke-la.com, recordedfuture.com, or flashpoint.io. This could indicate an analyst or automated system accessing threat intelligence resources.
This rule detects TFTP (Trivial File Transfer Protocol) requests for bootloader files. Specifically, it looks for UDP traffic on port 69 (the standard TFTP port) where the packet content starts with the byte sequence "00 01". This pattern is characteristic of a TFTP read request for a file, often used in network booting scenarios to retrieve bootloader files. The rule flags this activity as a "Possible Pre-OS Persistence" mechanism, suggesting an adversary might be attempting to establish persistence before the operating system fully loads, potentially through techniques like bootkits or modifying boot records.
This rule detects the string "flash write" in TCP network traffic flowing to a server, indicating a potential command to reflash component firmware. This activity could be associated with persistence techniques where an attacker modifies firmware to maintain access or control over a system.
Azure REST API Command Execution
Suricata
This rule detects HTTP POST requests to the Azure management API (management.azure.com). A high volume of such requests (20 within 10 seconds from the same source) could indicate automated activity, potentially related to command execution or resource manipulation within an Azure environment.
This rule detects HTTP POST requests to Azure Function or Azure Website domains. It specifically looks for hostnames ending in '.azurewebsites.net' or containing '.azurefunctions.' in a case-insensitive manner. A threshold of 20 such requests from the same source within 60 seconds triggers the alert, indicating potential automated activity or remote execution attempts against Azure-hosted applications.
This rule detects HTTP requests to URIs containing keywords associated with common IT management platforms (ConnectWise, Kaseya, SolarWinds, Datto, N-central). It specifically looks for established HTTP traffic flowing to the server. A threshold of 5 occurrences within 60 seconds from the same source IP is set to trigger an alert, indicating a potential remote access session or activity related to these platforms.
This rule detects RDP (Remote Desktop Protocol) sessions initiated towards the HOME_NET on port 3389. It specifically looks for the RDP connection initiation sequence (content:"|03 00|" with depth:2) and uses a threshold to detect multiple connections from the same source within a 5-minute window, which could indicate activity from a Managed Service Provider or other remote access scenarios.
This rule detects unusual application traffic on TCP port 8443. It triggers an alert if a source IP address initiates more than 20 TCP connections to port 8443 within a 60-second window. This threshold-based detection aims to identify potentially malicious or anomalous communication patterns that might indicate command and control activity or data exfiltration over a non-standard port often used for HTTPS.
This rule detects HTTP traffic where the host header contains specific cloud region identifiers that are considered rarely used. The rule is triggered if 10 such events occur within 60 seconds from the same source IP address. The identified regions are 'ap-east-1', 'me-south-1', 'af-south-1', and 'eu-south-1'. This could indicate an attempt to evade detection by using less common cloud infrastructure or an unauthorized API call from an unusual geographic location.
This rule detects HTTP traffic indicating an Amazon EC2 instance is being reverted to a snapshot. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RestoreSnapshotTier'. This activity could be part of a cleanup process or an attempt to restore a compromised instance to a known good state, but could also be used by an attacker for defense evasion by reverting changes.
This rule detects attempts to create new cloud instances, specifically targeting AWS EC2, by monitoring HTTP traffic for requests to 'ec2.amazonaws.com' with the 'RunInstances' URI. The rule is designed to identify suspicious activity related to the provisioning of new virtual machines in a cloud environment, potentially indicating unauthorized resource creation or evasion tactics.
This rule detects potential automated social media account creation attempts by monitoring HTTP traffic for requests to common social media platforms (twitter.com, x.com, facebook.com) that include 'signup' in the URI. A threshold of 5 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible automated or high-volume registration process.
This rule detects HTTP requests to known threat intelligence portals associated with dark web monitoring. It specifically looks for hostnames containing 'intel471', 'kela.io', 'recordedfuture', or 'flashpoint'. This could indicate an analyst or system accessing threat intelligence, or potentially an adversary performing reconnaissance.
This rule detects HTTP requests to 'crt.sh', a Certificate Transparency log search engine. Such requests can indicate an adversary performing reconnaissance to gather information about an organization's digital certificates and domains.
This rule detects HTTP requests made to the Shodan API (api.shodan.io). This activity is often associated with reconnaissance, where an attacker or security researcher uses Shodan to gather information about internet-connected devices and services. The rule specifically looks for the 'api.shodan.io' string within the HTTP host header, indicating an attempt to query the Shodan service.
Page 3 of 7