Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects the delivery of a payload via HTTP that contains the string "SetWindowsHookEx" (case-insensitive). This string is associated with a Windows API function used to install a hook procedure that monitors system events. Attackers often use this technique for persistence or to inject malicious code into other processes.
This rule detects HTTP PUT requests to Amazon S3 or Azure Blob Storage (cloud storage services) where the request body size is between 100 and 2000 bytes. This pattern is often indicative of one-way command and control (C2) communication, where an attacker might be exfiltrating small chunks of data or sending commands to a compromised host via cloud storage. The thresholding mechanism (20 events within 300 seconds from the same source) aims to reduce alerts from legitimate, infrequent cloud storage interactions.
This rule detects bidirectional Command and Control (C2) communication utilizing the Telegram Bot API. It specifically looks for HTTP traffic where the host is 'api.telegram.org' and the URI contains '/bot'. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects when Azure Monitor Diagnostic Settings are deleted. It specifically looks for HTTP DELETE requests to 'management.azure.com' with 'diagnosticSettings' in the URI. This activity could indicate an attacker attempting to evade detection by removing logging configurations.
This rule detects attempts to push firmware or bootkit images to a device via a remote SSH session. It specifically looks for the commands 'dd if=' and '/dev/' within TCP traffic directed to port 22 (SSH), indicating an attempt to write data directly to a device file, which is a common method for flashing firmware or installing bootkits.
This rule detects network traffic containing the string "signal(SIGTERM, SIG_IGN)" case-insensitively, indicating a process attempting to ignore the SIGTERM signal. This behavior can be used by malware or adversaries to achieve persistence on Linux systems by making a process harder to terminate gracefully.
This rule detects attempts to clear Windows network connection history remotely over SMB (port 445). It specifically looks for traffic containing the strings "NetworkList" and "delete" (case-insensitive) within TCP sessions directed to the HOME_NET on port 445. This activity could indicate an attacker attempting to remove forensic evidence of their network presence.
This rule detects attempts to spoof process arguments to evade detection by looking for specific strings in HTTP traffic. It specifically looks for the strings "NtQueryInformationProcess" and "ProcessCommandLineInformation" (case-insensitive) in file data within established HTTP client-to-server flows. This behavior is often associated with malware or advanced persistent threats trying to hide their true command-line arguments from security tools.
This rule detects attempts to clear system log files, specifically '/var/log/', via a remote SSH connection. It looks for the string "> /var/log/" within TCP traffic on port 22 (SSH) flowing from a client to a server, ignoring case. This activity is often associated with an attacker trying to cover their tracks by removing evidence of their presence.
This rule detects potential process argument spoofing attempts by looking for specific strings within HTTP traffic. It specifically searches for 'CreateProcessW' and 'lpCommandLine' in the file data of HTTP responses, indicating that a client might be receiving a payload designed to create a process with spoofed command-line arguments. This technique is often used by malware to hide its true intentions or evade detection.
This rule detects the use of the JamPlus build tool for potentially malicious execution. It specifically looks for HTTP traffic where the URI contains 'jamplus' or 'jam.exe' and the file data starts with 'MZ', indicating an executable file download. This combination suggests an attempt to deliver or execute a malicious JamPlus-compiled executable.
This rule detects the delivery of a Compiled HTML Help (CHM) file via HTTP that contains the string "ITSF" within its file data. CHM files can be used to deliver malicious content, and the presence of "ITSF" (likely indicating an InfoTech Storage Format header) combined with HTTP delivery suggests a potential attempt to bypass security controls or execute malicious code. This is often associated with T1218.001 (Signed Binary Proxy Execution: Compiled HTML Help) from the MITRE ATT&CK framework.
This rule detects HTTP requests containing 'verclsid' and '/S' in the URI, which is indicative of the Verclsid COM Object Proxy Execution technique (T1218.012). This technique is often used by attackers for defense evasion by executing arbitrary commands or binaries through a COM object.
This rule detects network traffic on port 445 (SMB) containing the strings "cacls" and "/G Everyone:F" (case-insensitive). This combination suggests an attempt to weaken folder permissions on a Windows system by granting full control to 'Everyone' using the `cacls` command, potentially via remote registry access or a similar mechanism that transmits the command over the network.
This rule detects attempts to download files that appear to be password hash lists or wordlists, often used for offline credential cracking. It specifically looks for HTTP URIs containing keywords like 'rockyou', 'passwords', 'wordlist', or 'hashlist' followed by '.txt', and only triggers if the downloaded file size is greater than 10,000 bytes. This activity is indicative of an attacker attempting to exfiltrate or acquire data for credential access.
This rule detects attempts to dump the Security Account Manager (SAM) hive using the 'reg save' command over HTTP. Specifically, it looks for HTTP requests containing 'reg save' and 'HKLM\SAM' in the URI, indicating an attempt to extract credential information from a Windows system.
This rule detects attempts to harvest Group Policy Preferences (GPP) credentials from the SYSVOL share over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "Groups.xml" in a case-insensitive manner, indicating a potential attempt to access the file where GPP credentials might be stored.
This rule detects attempts to read AutoLogon credentials from the Windows Registry over the network, specifically targeting SMB (port 445) traffic. It looks for the strings 'DefaultPassword' and 'Winlogon' in a case-insensitive manner within the TCP payload, indicating a potential attempt to extract stored credentials used for automatic login.
This rule detects attempts to access secrets stored in Google Cloud Platform (GCP) Secret Manager via its API. It specifically looks for HTTP traffic directed to 'secretmanager.googleapis.com' with a URI path containing '/versions/' and ':access', indicating an attempt to access a specific secret version.
This rule detects attempts to retrieve secret values from AWS Secrets Manager. It specifically looks for HTTP requests to 'secretsmanager.amazonaws.com' containing 'GetSecretValue' in the URI. This activity could indicate an attacker attempting to access sensitive credentials.
This rule detects the delivery of a Windows Credential Manager dump tool over HTTP. It specifically looks for the case-insensitive string "CredEnumerate" within the file data of an HTTP response flowing to the client. This string is indicative of tools designed to interact with or dump credentials from the Windows Credential Manager.
Page 70 of 93