Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects attempts to modify authentication configuration via LDAP by looking for the string "msDS-SupportedEncryptionTypes" in TCP traffic destined for port 389 (LDAP). This string is associated with changes to supported encryption types in Active Directory, which could be an indicator of persistence or privilege escalation.
This rule detects attempts to add an autostart entry via a remote registry write operation targeting TCP port 445 (SMB). It specifically looks for network traffic containing the strings "Run", "HKCU" (HKEY_CURRENT_USER), and "\Software\Microsoft\Windows", indicating a modification to the current user's run keys for persistence. This activity is often associated with malware or adversaries establishing persistence on a compromised Windows system.
This rule detects potential Remote Access Trojan (RAT) callbacks occurring after a remote support session. It specifically looks for HTTP GET requests where the URI contains keywords like 'setup', 'install', 'support', or 'remote' (case-insensitive) and the User-Agent header contains 'MSIE'. This combination suggests a possible RAT communicating with its command and control server, masquerading as legitimate remote support or installation traffic.
This rule detects DNS TXT record responses containing a Base64 encoded payload of at least 60 characters. This pattern is often used by malware for command and control (C2) communication or data exfiltration, leveraging DNS tunneling to evade detection.
This rule detects attempts to remotely shut down a system using the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic destined for port 445 (SMB). This activity can be indicative of an attacker attempting to disrupt services or systems.
This rule detects the download of a Microsoft Office document that is macro-enabled. It specifically looks for HTTP traffic flowing to the client (download) that contains both "[Content_Types].xml" and "vbaProject" within the file data. These strings are indicative of an Office Open XML (OOXML) file (like .docx, .xlsx, .pptx) that contains VBA macros, which are often used in phishing attacks for initial access.
This rule detects the download of a compiled AutoIT script payload over HTTP. It specifically looks for the 'AU3!' magic bytes at the beginning of the file data, which is characteristic of compiled AutoIT executables. The detection is focused on traffic flowing from the server to the client (to_client) and assumes an established connection.
This rule detects executable attachments (e.g., .exe, .bat, .cmd, .scr, .pif, .com) being delivered via SMTP email. It specifically looks for these file extensions within the 'filename' attribute of email attachments.
This rule detects the string "xdotool" within an SSH session (port 22) traffic flowing from the client to the server. xdotool is a command-line tool that simulates keyboard input and mouse activity, often used for automated input injection. Detection of this string suggests an attempt to automate actions within an SSH session, which could be indicative of malicious activity such as automated command execution or data exfiltration.
This rule detects attempts to set or modify an S3 bucket lifecycle policy for auto-deletion. It specifically looks for HTTP PUT requests to 's3.amazonaws.com' with a URI containing '?lifecycle'. This activity could indicate an attacker attempting to delete data after exfiltration or to destroy evidence.
This rule detects the execution of a system shutdown command ('shutdown -h now') over an SSH connection. It specifically looks for this string within TCP traffic directed to port 22 (SSH) on the home network, indicating a remote shutdown initiated via SSH.
This rule detects attempts to initiate a remote system shutdown via the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic directed to port 445 (SMB) on the home network. This activity is often associated with malicious behavior, such as ransomware or destructive attacks, aiming to disrupt systems.
This rule detects potential Command and Control (C2) communication utilizing DNS at the application layer. It specifically looks for DNS queries and triggers an alert if a single source IP performs more than 30 DNS queries within a 60-second window, indicating a high frequency of DNS activity that could be indicative of C2.
This rule detects HTTP responses where the 'Content-Type' header is 'application/json' and the response body contains both 'balance' and '0.00' (case-insensitive). This combination, especially in the context of a 'trojan-activity' classification, suggests a potential Man-in-the-Middle (MitM) attack manipulating financial or account balance data within a JSON response to show a zero balance.
This rule detects attempts to manipulate stored records within an MSSQL database. It specifically looks for TCP traffic directed to port 1433 (the default MSSQL port) containing the keywords "UPDATE" and "SET" (case-insensitive) in the flow to the server. A threshold of 50 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating potential bulk data modification.
This rule detects attempts to manipulate database data on a remote MySQL server (port 3306) by identifying 'UPDATE' and 'SET' SQL commands within TCP traffic. It uses a threshold to alert on a high frequency of these commands from a single source, indicating potential malicious activity like data modification or integrity compromise.
This rule detects drive-by malicious iframe injection by looking for HTTP responses (flow:to_client) that contain an iframe tag, the 'display:none' style attribute, and a 'src=' attribute. This combination is often used by attackers to embed malicious content invisibly into legitimate websites, leading to drive-by downloads or other client-side attacks.
This rule detects potential malicious script injection from ad networks. It looks for HTTP responses (flow:to_client) that contain common ad-related terms in the HTTP referer header (ad., ads., advert., banner.) and also contain JavaScript code obfuscation techniques like 'eval(' and 'fromCharCode' within the file data. This combination suggests an ad network might be serving malicious JavaScript to clients.
This rule detects HTTP response content injection via a Man-in-the-Middle (MitM) attack. It specifically looks for HTML content (indicated by 'Content-Type: text/html') in the HTTP response that contains a '<script' tag and a 'src' attribute pointing to an IP address (e.g., 'src="https?://[0-9]{1,3}\.[0-9]{1,3}'). This pattern suggests that an attacker might be injecting malicious scripts into legitimate web traffic.
This rule detects potential command and control (C2) activity where an internal HTTP proxy port (8080) is used as a relay. Specifically, it looks for HTTP CONNECT requests, which are commonly used for tunneling through proxies, directed to port 8080 within the home network. A threshold of 10 such requests within 60 seconds from a single source IP triggers the alert, indicating suspicious proxy usage for C2 communication.
This rule detects the use of SFTP (Secure File Transfer Protocol) as a covert command and control (C2) data channel. It specifically looks for TCP traffic on port 22 (SFTP's default port) with a specific content pattern ('|00 00 00|') within the first 4 bytes of the payload, a payload size between 100 and 500 bytes, and a high frequency (20 times in 60 seconds) from a single source IP address. This pattern and frequency could indicate an attempt to exfiltrate data or maintain C2 communication disguised as legitimate SFTP traffic.
Page 73 of 93