Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
234
2
Contributors
120
68
21
9
8
Categories
133
104
94
78
68
Platforms
220
16
8
4
4
Products / Services
230
105
23
6
4
MITRE Techniques
96
48
25
25
23
CVEs
1
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
102
64
21
14
8
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects HTTP POST requests that contain data resembling a ZIP archive (indicated by 'PK' header) and have a size greater than 50,000 bytes. This pattern is often associated with data exfiltration where collected data is archived before being sent out of the network.
This rule detects a high volume of HTTP GET requests to Azure Blob Storage, specifically targeting '.blob.core.windows.net' domains. A threshold of 50 requests within 60 seconds from a single source IP address triggers the alert, indicating a potential bulk data download activity. This could be indicative of data exfiltration or unauthorized access to cloud storage.
This rule detects a high volume of HTTP GET requests to AWS S3 buckets from a single source IP address within a short timeframe. Specifically, it triggers if more than 50 GET requests are observed within 60 seconds to hosts matching 's3.amazonaws.com' or '.s3.' patterns. This behavior can indicate an attempt to exfiltrate data or perform bulk collection from an S3 bucket.
This rule detects access to known dark web credential markets by inspecting HTTP host headers for specific domain patterns. It triggers an alert if a client on the home network attempts to connect to 'genesis.market', 'russianmarket', or '2easy.shop'. This indicates potential reconnaissance or direct access to platforms where stolen credentials are traded.
This rule detects potential Tor network traffic by looking for specific byte patterns (TLS handshake ClientHello with version 1.0 or 1.1) in TCP traffic flowing from the internal network to any external destination. It uses a threshold of 3 occurrences within 60 seconds from the same source IP to reduce false positives. The rule specifically targets the initial bytes of a TLS handshake, which is a common characteristic of Tor's encrypted communication.
This rule detects a high volume of DNS TXT queries originating from the home network to any destination on port 53. This behavior is indicative of potential DNS exfiltration, where data is encoded and transmitted via DNS TXT records. The rule triggers an alert if 30 or more TXT queries are observed from a single source within a 60-second window.
This rule detects potential data exfiltration to Google Drive by monitoring HTTP POST requests to 'www.googleapis.com' with a data size greater than 5000 bytes. This pattern is indicative of large data uploads to Google's API services, which could be used for exfiltration.
This rule detects network connections to TCP port 3334, which is commonly used by the Stratum protocol for cryptocurrency mining. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection originating from the home network ($HOME_NET) to any destination. This activity is indicative of potential cryptomining operations within the monitored network.
This rule detects outbound TCP connections on port 9050, which is commonly used by the Tor anonymity network. The rule is configured to trigger an alert if there are at least 3 such connections from the same source within a 60-second window, indicating potential use of Tor. The message suggests this activity is related to accessing an Initial Access Broker market.
This rule detects network traffic to known initial access broker (IAB) market domains. It specifically looks for HTTP requests where the host matches 'exploit.in', 'xss.is', 'raidforums', or 'breachforums' and the URI contains the word 'access'. This indicates potential activity related to purchasing or selling initial access to compromised systems.
This rule detects HTTP traffic where the client body contains the terms "rdp" and "buy" (case-insensitive). This combination suggests a potential attempt to purchase RDP access, possibly on an underground forum, which is a policy violation.
This rule detects HTTP requests to known underground forums (nulled.to, hackforums.net, ogusers) via a clearnet proxy. It specifically looks for these hostnames in HTTP traffic.
This rule detects the transmission of cleartext credentials over Telnet by looking for the string "Password:" in traffic flowing to the server on port 23. Telnet is an insecure protocol that sends data, including login credentials, in plain text, making it vulnerable to eavesdropping.
This rule detects the transmission of cleartext credentials over FTP by looking for the "PASS " string in network traffic flowing to an FTP server on port 21. This indicates that a password is being sent without encryption, which is a security risk.
This rule detects large HTTP POST requests containing GZIP compressed data (identified by the magic bytes '|1F 8B|') with a size greater than 100,000 bytes. This behavior is indicative of possible data staging or exfiltration, where an attacker might compress and upload sensitive data from a compromised system.
Confluence Wiki Bulk Export
Suricata
This rule detects HTTP requests to the '/spaces/exportspace.action' URI, which is associated with bulk export functionality in Confluence Wiki. This activity could indicate an attempt to exfiltrate data from a Confluence instance.
This rule detects a high volume of document downloads from SharePoint, specifically looking for repeated access to the `/_layouts/download.aspx` URI. A threshold of 30 downloads within 60 seconds from a single source IP address triggers the alert. This behavior could indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects potential DNS tunneling activity by identifying DNS queries with high entropy subdomains. Specifically, it looks for subdomains that consist of 30 or more alphanumeric characters (a-z, 0-9). A threshold is applied, triggering an alert if 5 such queries are observed from the same source IP within a 60-second window. This pattern is often indicative of data exfiltration or command and control communication over DNS.
This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9150. This port is commonly used by Tor Browser for its SOCKS proxy, indicating potential use of Tor for anonymization or to bypass network restrictions. The rule specifically looks for the SYN flag in the TCP handshake, signifying the initiation of a connection.
This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9050, specifically looking for the SYN flag. Port 9050 is commonly associated with Tor SOCKS proxy services. This activity is classified as a policy violation and is linked to the MITRE ATT&CK technique T1090.003, which involves using a Tor proxy for defense evasion.
Page 10 of 12