Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
127 detections
Filters
Last updated
All Time
Detection languages
127
Contributors
93
34
Categories
52
48
20
19
15
Platforms
117
13
6
5
3
Products / Services
125
5
2
1
1
MITRE Techniques
29
29
22
16
15
IDS Classtypes
1,937
503
461
381
236
127
IDS Protocols
57
19
19
18
12
This rule detects network connections to port 9090 on the home network. The rule is specifically tagged with MITRE ATT&CK technique T1072 (System Configuration Discovery) and mentions 'Ansible/Remote Deploy', suggesting it aims to identify potential remote management or deployment activities that might use this port. It triggers on TCP SYN packets (flags:S) and uses a threshold of 5 connections from the same source within 60 seconds to reduce noise.
This rule detects potential network sniffing by identifying an unusual mix of network protocols originating from a single source IP address. Specifically, it triggers an alert if a source IP sends 10 or more packets within 60 seconds that are neither TCP (protocol 6), UDP (protocol 17), nor ICMP (protocol 1). This behavior could indicate an attacker using tools to capture raw network traffic, as these tools often process protocols beyond the common ones.
This rule detects DNS queries for typosquatted domains related to npmjs. Specifically, it looks for queries to domains ending in 'npmjs.net', 'npmjs.org', 'npmjs.io', or 'npmjs.co'. This is indicative of potential supply chain attacks or attempts to trick users into downloading malicious packages from fake registries.
This rule detects a sequence of TCP SYN packets with a zero data size, originating from any source to any destination within the home network. The detection is triggered when 5 such packets are observed from the same source within a 3-second window. This pattern is indicative of a 'Magic Packet Implant Activation Sequence', which could be used by an attacker for persistence or command and control.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive strings "powercfg" and "change". This combination suggests an attempt to modify system power settings, potentially to prevent a system from sleeping or shutting down, which could be a persistence mechanism.
This rule detects HTTP POST requests to 'cloudfunctions.net', indicating a Google Cloud Function is being triggered for execution. The rule uses a threshold to alert only if 20 such requests are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent triggers.
This rule detects HTTP POST requests to AWS Lambda invocation endpoints, specifically targeting URLs matching the pattern '/lambda.[a-z0-9-]+.amazonaws.com' with the URI '/invocations'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential code execution activity via AWS Lambda.
This rule detects TFTP (Trivial File Transfer Protocol) traffic on UDP port 69, specifically looking for a content pattern that indicates a firmware push. The pattern '|00 02|' at the beginning of the UDP payload suggests a TFTP write request (opcode 2), which is commonly used for uploading files, including firmware, to network devices. The rule is designed to alert on such activity directed towards the local network ($HOME_NET).
This rule detects DNS queries for domains that resemble update servers used in the SolarWinds supply chain attack. Specifically, it looks for DNS queries containing 'update' followed by 'solarwinds', 'orion', 'avupdate', or 'antivirus' in the domain name. This pattern was associated with the SUNBURST backdoor's communication with its command and control infrastructure.
This rule detects Address Resolution Protocol (ARP) announcements from new or unknown devices on the network. Specifically, it looks for ARP packets with an opcode of '2', which signifies an ARP reply. The rule uses a threshold to trigger an alert if a new ARP reply is observed from a source within a 5-second window, indicating a potential new device joining the network or an attempt at ARP spoofing.
This rule detects HTTP requests to known dedicated server rental providers (ovh.com, leaseweb.com, servermania.com) where the URI contains the word 'order'. This activity could indicate an adversary attempting to rent infrastructure for attack purposes, such as command and control servers, phishing sites, or other malicious operations.
This rule detects potential use of a compromised Virtual Private Server (VPS) as a proxy relay. It specifically looks for HTTP CONNECT requests, which are commonly used for tunneling traffic through a proxy. A threshold of 10 CONNECT requests within 60 seconds from a single source IP is set to identify suspicious activity, indicating a high volume of proxy usage.
This rule detects attempts to purchase code signing certificates by monitoring HTTP traffic for connections to known certificate authorities (Sectigo, Comodo, Digicert) and the presence of the term 'codesigning' in the URI. This could indicate an adversary attempting to acquire legitimate code signing certificates for malicious purposes, such as signing malware to evade detection.
This rule detects the use of a code signing certificate that is suspected to be stolen. It specifically looks for HTTP traffic where the TLS certificate subject contains an organization name matching a common corporate naming convention (e.g., 'O=Company Inc', 'O=Company LLC', 'O=Company Ltd', 'O=Company Corp') and the issuer is 'DigiCert'. This combination suggests a potentially legitimate certificate being used in an unauthorized context, possibly for signing malicious software.
This rule detects suspicious access to domain registration services by monitoring HTTP traffic for requests to known domain registrars (namecheap.com, godaddy.com, porkbun.com) with a URI containing 'register'. A threshold of 5 such requests within 60 seconds from the same source IP triggers an alert, indicating potential resource development activity such as bulk domain registration.
This rule detects unauthorized DNS server responses originating from external hosts. Specifically, it looks for UDP traffic on port 53 (DNS) with a specific content signature '|84 00|' at an offset of 2 bytes and a depth of 2 bytes, which corresponds to a DNS response header indicating a standard query response. The rule uses a threshold to alert if 10 such responses are observed from the same source within 30 seconds, suggesting a potential unauthorized or malicious DNS activity.
This rule detects network connections to known exploit sales platforms such as exploit.in, 0day.today, and leakbase. It specifically looks for HTTP traffic where the host header matches one of these domains, indicating potential access to marketplaces for exploits and zero-day vulnerabilities.
This rule detects DNS queries for top-level domains (TLDs) commonly associated with bulletproof hosting services. Specifically, it looks for queries ending in .ru, .cn, .tk, .ml, .ga, .cf, or .gq. A threshold of 20 queries within 60 seconds from the same source IP will trigger an alert.
This rule detects suspicious DNS lookups for 'pastebin.com'. It triggers an alert if a source IP performs 5 or more DNS queries for 'pastebin.com' within a 60-second window. This activity is often associated with reconnaissance, as attackers may use Pastebin to host command and control (C2) information, exfiltrated data, or other malicious content.
This rule detects HTTP traffic indicating an attempt to terminate an EC2 instance on AWS. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with 'TerminateInstances' in the URI, which is a common API call used to delete cloud instances. This activity could be performed by an attacker to remove evidence of their presence or to disrupt services.
This rule detects when a cloud disk snapshot is created, specifically targeting AWS EC2 'CreateSnapshot' API calls. This activity can be indicative of data exfiltration attempts, where an attacker creates a snapshot of a compromised disk to move data out of the environment.
Page 4 of 7