Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects attempts to exploit DLL Search Order Hijacking vulnerabilities by monitoring SMB network traffic for requests containing '.dll' and '\AppData\' in the content. This pattern suggests an attacker might be attempting to drop a malicious DLL into a user's AppData directory on a network share, which could then be loaded by a legitimate application due to search order vulnerabilities, leading to persistence or execution of malicious code.
This rule detects attempts to hijack the PATH environment variable during an SSH session. It specifically looks for the string "export PATH=" within TCP traffic on port 22 (SSH), indicating a potential malicious modification of the PATH environment variable to control command execution paths.
This rule detects attempts to hijack the dynamic linker's LD_PRELOAD mechanism over an SSH connection. It specifically looks for the string "LD_PRELOAD" within TCP traffic on port 22 (SSH). This technique is often used by attackers for persistence or privilege escalation by injecting malicious libraries into legitimate processes.
This rule detects attempts to hijack macOS applications using malicious dynamic libraries (DYLIBs). It specifically looks for HTTP responses containing a URI with the ".dylib" extension and the content "__TEXT" within the file data, indicating a Mach-O executable segment. This combination suggests the delivery of a potentially malicious dynamic library designed for hijacking purposes on macOS systems.
This rule detects the HTTP download of common boot script file types (batch, command, shell, PowerShell) that contain the string 'HKLM' (HKEY_LOCAL_MACHINE). This combination suggests an attempt to establish persistence or execute malicious code by modifying system-wide registry settings, often associated with trojan activity. The detection is based on the file extension in the URI and the content within the downloaded file's data.
This rule detects network traffic on port 445 (SMB) containing the strings "services.exe" and "ImagePath" (case-insensitive). This combination suggests an attempt to hijack the execution flow of a service by replacing its binary, specifically targeting the 'services.exe' process, which is a critical Windows component. The rule is designed to identify trojan activity related to persistence mechanisms.
This rule detects attempts to modify the shared library configuration file '/etc/ld.so' over an SSH connection. This activity is indicative of a shared library hijacking technique, often used for persistence or privilege escalation, where an attacker modifies the system's library loading paths to inject malicious libraries. The detection specifically looks for the string "/etc/ld.so" within TCP traffic destined for port 22 (SSH) on the home network.
This rule detects when an executable file (.exe) is dropped into a Windows 'Start Menu\Programs\Startup' folder via Server Message Block (SMB). This is a common technique used by attackers to establish persistence on a compromised system, ensuring that their malicious code runs every time the user logs in or the system starts.
This rule detects the download of ISO, IMG, VHD, or VHDX files over HTTP that are larger than 500KB. These file types are often used as containers for malware delivery, allowing attackers to bypass traditional file-based security controls by embedding malicious executables or scripts within disk images.
This rule detects potential HID (Human Interface Device) keystroke injection attacks via USB emulation. It specifically looks for HTTP client body content containing both the terms 'keyboard' and 'inject' (case-insensitive). This pattern suggests an attempt to simulate keyboard input, often associated with devices like 'BadUSB' or 'Rubber Ducky' that emulate a keyboard to deliver malicious keystrokes.
This rule detects attempts to download executable files disguised as common media file types (MP4, MP3, AVI, MOV) over HTTP. It specifically looks for the 'MZ' header, which indicates a Windows executable, within the first two bytes of the file data, combined with a URI ending in a media file extension. This technique is often used by attackers to bypass security controls and trick users into executing malicious payloads.
This rule detects attempts to abuse an IoT device's firmware update page by sending a large POST request containing the word "firmware" (case-insensitive) to TCP port 80 on the home network. This activity is indicative of an attempt to corrupt the device's firmware, potentially leading to denial of service or unauthorized control.
This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.
This rule detects potential C2 beaconing activity over HTTP. It specifically looks for HTTP GET requests where the URI path consists of 8 to 16 lowercase alphanumeric characters. The rule uses a threshold of 20 such requests within 60 seconds from the same source IP address to identify beaconing behavior.
This rule detects attempts to replace cryptocurrency wallet addresses within HTTP POST requests. It specifically looks for patterns matching Bitcoin (P2PKH, P2SH, Bech32) and Ethereum (0x) wallet addresses in the client body of HTTP POST requests. This activity is indicative of clipboard hijacking or similar malware that aims to redirect cryptocurrency transactions to an attacker's wallet.
This rule detects potential tampering with financial transaction data during transit. It specifically looks for TCP traffic flowing to a server, where the data size is between 100 and 500 bytes, and the content contains both "amount" and "transfer" (case-insensitive). This combination suggests an attempt to modify financial transaction details.
This rule detects the use of AMQP (Advanced Message Queuing Protocol) on port 5672, specifically looking for the 'AMQP' content within the first 4 bytes of the TCP payload. It triggers an alert if this pattern is observed 5 times within 60 seconds from the same source IP, indicating potential Command and Control (C2) activity using AMQP as a communication channel.
FTP Used as C2 Command Channel
Suricata
This rule detects potential command and control (C2) activity over FTP by identifying a high frequency of 'RETR' (retrieve) commands. A threshold of 20 'RETR' commands within 60 seconds from the same source IP address triggers the alert. This pattern can indicate an attacker using FTP to download commands or tools from a C2 server.
This rule detects C2 traffic that attempts to impersonate legitimate Microsoft Update services. It specifically looks for HTTP traffic where the host header contains 'windowsupdate.com' or 'update.microsoft.com' (case-insensitive) and the User-Agent header contains 'Windows-Update-Agent'. A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, indicating potential command and control activity trying to blend in with normal Windows update traffic.
This rule detects HTTP POST requests from the home network to any destination that contain a large amount of junk data padding in the client body. Specifically, it looks for a client body size greater than 1000 bytes and a PCRE match for at least 500 alphanumeric characters, indicating potential command and control (C2) communication using data padding for obfuscation or to bypass detection. A threshold is set to trigger an alert if 10 such requests are observed from the same source within 60 seconds.
This rule detects network traffic that uses a TLS certificate with the common name (CN) 'Major Cobalt Strike'. This specific CN is a known default value used by the Cobalt Strike command and control (C2) framework. Detection of this certificate indicates potential Cobalt Strike C2 communication within the network.
Page 78 of 93