Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects attempts to build a Docker image on a compromised host via the Docker API. It specifically looks for HTTP POST requests to the '/build' endpoint on port 2375, which is the default unsecured Docker API port. This activity could indicate an attacker leveraging a compromised system to build malicious Docker images.
This rule detects HTTP requests where the URI contains "SyncAppvPublishingServer" case-insensitively. This pattern is often associated with script proxy execution, a technique used by attackers to execute malicious scripts by leveraging legitimate system utilities. The rule specifically looks for this string in the URI of established, to-server HTTP flows, indicating potential trojan activity or defense evasion.
This rule detects HTTP requests where the URI contains both 'pubprn' and '.sct' (case-insensitive). This combination is indicative of an attempt to use the 'pubprn.vbs' script for COM scriptlet execution, a technique often employed by attackers for defense evasion.
This rule detects potential modification of a network device's system image via TFTP. It specifically looks for UDP traffic on port 69 (TFTP) where the packet size is greater than 50000 bytes and contains the byte sequence "|00 02|" at a depth of 2 bytes, which is indicative of a TFTP write request (opcode 2). The large packet size suggests a system image transfer.
This rule detects the string "ComRegisterFunction" within HTTP response bodies (file.data). This string is associated with .NET assembly registration, specifically when tools like Regsvcs or Regasm are used for 'Assembly Proxy Execution'. This technique is often employed by attackers for defense evasion, as it allows them to execute malicious code via legitimate Microsoft utilities.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of timing-based anti-debugging techniques. It looks for the presence of "__rdtsc" (Read Time-Stamp Counter) and "ExitProcess" within the file data of an HTTP response, suggesting that a program might be attempting to detect a debugger by measuring execution time and exiting if debugging is detected. This is a common technique used by malware to evade analysis.
This rule detects potential in-memory PE loading without disk write by looking for specific strings in HTTP file data. It specifically searches for the strings "Assembly.Load(" and "Invoke(" (case-insensitive) within the HTTP response body (flow:to_client,established; file.data). This combination of strings is indicative of .NET applications dynamically loading assemblies into memory and then executing methods, which can be a technique used by malware to avoid writing executables to disk.
This rule detects the string "sekurlsa" within the HTTP URI, which is commonly associated with the Mimikatz tool attempting to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. The detection is case-insensitive and targets traffic flowing from the client to the server.
This rule detects network traffic on port 445 (SMB) containing the string "SetFileSecurity" (case-insensitive). This string is associated with modifying file security descriptors, specifically Discretionary Access Control Lists (DACLs), which can be used by attackers to hide malicious files or achieve persistence by altering permissions.
This rule detects attempts to use 'mavinject.exe' for DLL injection into a running process over HTTP. It specifically looks for HTTP requests containing 'mavinject' and '/INJECTRUNNING' in the URI, indicating a potential malicious use of the Mavinject utility for defense evasion.
This rule detects JavaScript code being delivered to a client that attempts to capture form field data, specifically looking for 'document.querySelector', 'password', and 'fetch(' within HTTP response data. This behavior is indicative of an attempt to exfiltrate credentials from a login page.
This rule detects the presence of a web portal login page skimmer script by looking for specific JavaScript keywords within HTTP response data. It specifically searches for the combination of 'addEventListener', 'keydown', and 'XMLHttpRequest' (case-insensitive) in the data flowing from the server to the client. This combination suggests a script designed to capture user input (like keystrokes) and exfiltrate it via XMLHttpRequest, a common technique used by web skimmers to steal credentials.
This rule detects attempts to spoof a Windows login credential dialog box over HTTP. It specifically looks for the string "CredUIPromptForCredentials" (case-insensitive) within the file data of HTTP traffic flowing from the server to the client. This string is associated with the Windows Credential UI API, and its presence in unexpected contexts, especially in HTTP responses, could indicate a phishing attempt or malware trying to trick users into entering credentials.
This rule detects attempts to copy SSL private key files over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings ".key" and "private" (case-insensitive) in the data being sent to the server. This activity could indicate an attacker attempting to exfiltrate sensitive cryptographic material.
This rule detects attempts to copy the Chrome Login Data SQLite file over SMB. The rule specifically looks for SMB traffic (port 445) containing the strings "Login Data" and "AppData\Local\Google\Chrome" (case-insensitive). This activity is indicative of an attacker trying to exfiltrate sensitive browser data, specifically stored credentials.
This rule detects attempts to dump memory from the 'securityd' process on macOS systems, specifically looking for the string 'securityd' and 'ptrace' in TCP traffic on port 22. This activity is indicative of credential access attempts, as 'securityd' handles sensitive security information.
This rule detects attempts to dump the macOS Keychain via a remote SSH connection. It specifically looks for the string "security dump-keychain" within TCP traffic on port 22 (SSH). This command is used to extract credentials and other sensitive information stored in the macOS Keychain.
This rule detects HTTP requests to the Docker API endpoint '/containers/*/json' which could indicate an attempt to query container environment secrets. The rule specifically looks for requests to the '/containers/' path followed by '/json' in the HTTP URI.
This rule detects a specific HTTP POST request pattern associated with the Mirai botnet's check-in mechanism. It looks for HTTP POST requests to the '/report' URI with a body size between 21 and 99 bytes. A threshold of 10 such requests from the same source within 60 seconds triggers the alert, indicating potential botnet activity.
This rule detects the download of potential proof-of-concept (PoC) exploit code for CVEs. It specifically looks for HTTP responses containing a URI that matches the pattern 'CVE-YYYY-NNNN' (e.g., CVE-2023-1234) and also contains the word 'exploit' in the file data. This combination suggests that a client on the internal network is downloading code related to a known vulnerability, which could be for research, testing, or malicious purposes.
This rule detects attempts to download raw payload files (PowerShell scripts, executables, DLLs, batch files, VBScripts, Python scripts, or shell scripts) from raw.githubusercontent.com. This activity is often associated with adversaries attempting to retrieve malicious tools or scripts from code repositories.
Page 80 of 93