Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
127 detections
Filters
Last updated
All Time
Detection languages
127
Contributors
93
34
Categories
52
48
20
19
15
Platforms
117
13
6
5
3
Products / Services
125
5
2
1
1
MITRE Techniques
29
29
22
16
15
IDS Classtypes
1,937
503
461
381
236
127
IDS Protocols
57
19
19
18
12
This rule detects when an AWS Organization Unit (OU) is modified, specifically when the 'MoveAccount' API call is made to 'organizations.amazonaws.com'. This activity could indicate an attempt to evade detection or alter the organizational structure for malicious purposes.
This rule detects attempts to modify an Azure Management Group, specifically when a PUT request is made to 'management.azure.com' with 'managementGroups' in the URI. This activity could indicate an attempt to evade defenses by altering management group configurations.
This rule detects attempts to change the power plan on a system via a remote web shell. It specifically looks for HTTP requests containing 'powercfg' and 'setactive' in the URI, indicating the use of the 'powercfg /setactive' command, which is used to change the active power scheme. This activity suggests an attacker might be trying to manipulate system power settings, potentially for persistence or to interfere with system operations.
This rule detects VNC (Virtual Network Computing) remote access sessions initiated from any source IP address to any IP address within the local network ($HOME_NET) on port 5900. It specifically looks for the 'RFB 00' string within the first 7 bytes of the TCP payload, which is characteristic of the VNC protocol handshake. A threshold is applied to trigger an alert if 3 such connections are observed from the same source IP within a 60-second window, indicating potential repeated or sustained VNC activity.
This rule detects potential DNS hijacking attempts via a compromised resolver. It specifically looks for UDP traffic on port 53 (DNS) to the home network, containing the DNS response code '81 80' (indicating a standard query response) and the PCRE pattern '/\x00\x01\x00\x00/' which corresponds to a single question in the DNS query. A threshold of 20 occurrences within 10 seconds from the same source IP triggers the alert, suggesting a high volume of suspicious DNS responses.
This rule detects a high volume of outbound TCP communication from the home network to any destination on port 8080. This pattern can indicate a compromised server acting as a proxy or engaging in other suspicious network activity, potentially for resource development or command and control.
This rule detects HTTP requests to domains associated with corporate intelligence subscription services such as Dun & Bradstreet (dun.com, dnb.com) and Hoovers (hoovers.com). It triggers an alert if a single source IP makes 10 or more such requests within a 60-second window, indicating potential reconnaissance activity.
This rule detects HTTP requests to known data broker websites such as Spokeo, Intelius, and BeenVerified. It triggers an alert if 10 or more such requests are observed from a single source IP within a 60-second window. This activity could indicate reconnaissance efforts to gather information about individuals.
This rule detects Wake-on-LAN (WoL) magic packets. WoL is a network standard that allows a computer to be turned on or woken up by a network message. While legitimate, adversaries can use WoL to activate compromised systems (implants) for command and control or other malicious activities, especially if the system was previously shut down to evade detection.
SQL Database Version Discovery
Suricata
This rule detects attempts to discover the version of a SQL database, often a precursor to SQL injection attacks or other reconnaissance activities. It specifically looks for SQL queries containing keywords like 'select' and 'version' in various common formats used to retrieve database version information.
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo-rmm .azurewebsites .net)
This rule detects TLS Server Name Indication (SNI) requests for 'store.steampowered.com'. This domain is associated with the Valve Steam Store and its presence in TLS SNI could indicate activity related to information stealers like Vidar Stealer, which has been observed targeting Steam accounts.
This rule detects HTTP POST requests to github.com's /login/device/code endpoint that contain a 'client_id=' in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens.
ET INFO Observed RMM Domain in DNS Lookup (meshcentral .com)
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo .tech)
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo-rmm .azurewebsites .net)
This rule detects inbound network traffic attempting to exploit an open redirect vulnerability within the Google APIs 'AddItNow' service. Specifically, it looks for requests to 'apis.google.com/additnow/l?__lu=' which could be used to redirect users to arbitrary malicious websites.
ET INFO Blockchain RPC Domain in DNS Lookup (api .avax .network)
ET INFO Observed DNS Query to Actor Abused Online Service Domain (getenjoyment .net)
ET INFO Blockchain RPC Domain in DNS Lookup (mainnet .infura .io)
ET INFO Observed VNT VPN Domain (vnt .wherewego .top in TLS SNI)
Page 5 of 7