Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects attempts to access the Windows Credential Manager Vault remotely over TCP port 445 (SMB). It specifically looks for the string "vaultcmd" in the network traffic, which is a command-line utility used to manage credentials in the Credential Manager. This activity could indicate an attacker attempting to extract stored credentials from a compromised system.
This rule detects attempts to exfiltrate browser password databases over HTTP. It specifically looks for HTTP POST requests containing the string "Login Data" in the client body, which is a common indicator of browser credential theft.
This rule detects the delivery of a macOS Keychain Access tool via HTTP. It specifically looks for the string "SecKeychainFindInternetPassword" within the file data of HTTP traffic flowing from the server to the client. This string is indicative of an application attempting to access or manipulate macOS Keychain passwords, suggesting the presence of malware or a malicious utility designed to extract credentials.
This rule detects the exfiltration of a password store database over HTTP POST. It specifically looks for HTTP POST requests where the URI or content contains the string "passwords" (case-insensitive) and the data size is greater than 1000 bytes. This combination suggests a large file, potentially a database, containing passwords being sent out of the network.
This rule detects potential abuse of a Certificate Enrollment Web Service (typically Microsoft's CertEnroll) for forgery attempts. It specifically looks for HTTP requests to the '/certenroll/' URI on port 80 (HTTP) within the home network. A threshold of 10 such requests from a single source IP within 60 seconds is set to trigger the alert, indicating a possible automated or rapid attempt to interact with the certificate enrollment service.
This rule detects network traffic to a specific URI path associated with Active Directory Certificate Services (AD CS) enrollment. The URI '/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP' is known to be used in Certificate Enrollment Policy (CEP) web services, which can be abused in ESC1 (ESC1 Certificate Template Privilege Escalation) attacks to obtain certificates with elevated privileges. The rule specifically looks for TCP traffic on port 443 (HTTPS) to this URI, indicating an attempt to interact with the CEP service.
This rule detects the exfiltration of Kerberos credential cache (ccache) files over SSH SCP. It specifically looks for the string "KRB5CCNAME" within TCP traffic on port 22 (SSH), indicating the potential transfer of a ccache file, which often contains this environment variable name.
This rule detects when a Kerberos credential cache (ccache) file is copied over SMB. Attackers may attempt to steal Kerberos ccache files to obtain Kerberos tickets, which can then be used for various credential access attacks like 'Pass the Ticket'. The rule specifically looks for the string '.ccache' within SMB traffic on port 445, indicating the transfer of such a file.
This rule detects network traffic indicative of AnyDesk remote desktop software being used as a command and control (C2) channel. It specifically looks for HTTP requests to 'anydesk.com' or 'relay.anydesk.com' domains. A threshold of 5 connections within 60 seconds from the same source IP is set to reduce false positives.
This rule detects potential command and control (C2) channel activity by identifying HTTP requests where the URI contains specific keywords commonly associated with C2 infrastructure switching or staging. The keywords include 'stage2', 's2', 'next', 'pivot', and 'relay'. This indicates an attacker might be moving to a new phase of their operation or redirecting C2 communications.
This rule detects potential bidirectional command and control (C2) activity leveraging Discord webhooks. It specifically looks for HTTP POST requests to 'discord.com' with the URI containing '/api/webhooks/'. A threshold of 5 such requests within 60 seconds from the same source IP is set to reduce false positives and indicate sustained communication, characteristic of C2.
This rule detects DNS queries for 'pastebin.com' that occur at a high frequency (5 times within 60 seconds from the same source IP). This pattern is indicative of a Dead Drop Resolver Command and Control (C2) mechanism, where attackers use services like Pastebin to host C2 instructions or data, and malware frequently queries these services to retrieve commands or exfiltrate data. The rule specifically targets DNS traffic on port 53.
This rule detects network traffic indicative of a compromised host attempting to beacon to a botnet command and control server. Specifically, it looks for HTTP requests where the URI path contains "/gate.php". This pattern is commonly associated with botnet communication.
This rule detects the download of a potential post-exploitation framework binary over HTTP. It looks for HTTP responses containing the 'MZ' magic bytes (indicating a Windows executable) and specific keywords like 'beacon', 'agent', 'implant', 'payload', or 'stager' in the HTTP URI. This combination suggests an attempt to deliver malicious tools to a compromised system.
This rule detects the download of remote support tools such as AnyDesk, TeamViewer, Atera, Splashtop, and ConnectWise. The detection is based on HTTP URI patterns that match these tool names. This activity is often associated with phone scams where attackers trick users into installing remote access software, giving the attackers control over their systems.
This rule detects suspicious background downloads initiated via BITS (Background Intelligent Transfer Service) where the HTTP User-Agent contains "Microsoft BITS" and the requested URI ends with common executable or script file extensions (.exe, .dll, .ps1, .bat). This behavior can indicate an adversary using BITS for ingress tool transfer or to download malicious payloads.
This rule detects HTTP downloads where a file is disguised as a PDF but is actually an executable. It specifically looks for the 'MZ' magic bytes (indicating a Windows executable) within the first two bytes of the file data, combined with a '.pdf' extension in the HTTP URI. This is a common technique used by attackers to bypass security filters and trick users into executing malicious code.
This rule detects the download of a malicious Office template file (.dotm) over HTTP. The rule specifically looks for HTTP traffic flowing to the client that contains the ".dotm" string in the URI, indicating a potential template injection attack where a malicious template is delivered to a user.
This rule detects potential DNS response spoofing or DNS hijacking attempts. It specifically looks for UDP traffic on port 53 (DNS) where a high number of responses (5 within 10 seconds) are observed for a given destination IP address, which could indicate an attacker attempting to inject malicious DNS responses.
MySQL Database DROP TABLE Attack
Suricata
This rule detects attempts to drop tables in a MySQL database. It specifically looks for the 'DROP TABLE' string in TCP traffic directed to the standard MySQL port (3306) on the home network. This activity is often indicative of malicious intent, such as data destruction or database tampering.
This rule detects the download of tools or files that contain 'uac' and 'bypass' in their HTTP URI. This is indicative of an attempt to download a User Account Control (UAC) bypass tool, which adversaries might use for privilege escalation on Windows systems.
Page 76 of 93