Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This Suricata rule detects potential steganography payloads embedded within image downloads. It specifically looks for the JPEG file signature `FF D8 FF` within the first 3 bytes of an HTTP response, combined with a large file size (greater than 500KB). The rule also includes a threshold to prevent excessive alerts, triggering if 5 such downloads occur from the same destination within 60 seconds. This behavior is indicative of an attempt to hide malicious code or data within seemingly innocuous image files to evade detection.
This rule detects potential domain fronting by identifying a mismatch between the Server Name Indication (SNI) field in the TLS handshake and the Host header, specifically when the SNI field contains domains commonly used for content delivery networks (CDNs) like cloudfront.net, azureedge.net, or fastly.net. This technique can be used to obfuscate the true destination of network traffic, often for malicious purposes such as bypassing censorship or exfiltrating data.
Obfuscated VBScript Download
Suricata
This rule detects the download of potentially obfuscated VBScript files over HTTP. It specifically looks for the string 'Chr(' repeated multiple times within the first 200 bytes of the file data, which is a common obfuscation technique used in malicious VBScripts to hide their true content.
This rule detects attempts to download known exploit framework tools such as Metasploit, Cobalt Strike, Empire, Covenant, Sliver, or Havoc by inspecting HTTP URI content. The detection is based on case-insensitive pattern matching within the HTTP URI.
Payload Download from GitLab Raw
Suricata
This rule detects attempts to download executable or script files (PowerShell, executable, DLL, shell script, Python script) from the 'raw' content section of gitlab.com. This behavior is often associated with adversaries staging or retrieving malicious payloads.
This Suricata rule detects HTTP requests containing 'VBoxService' in the URI. This string is associated with VirtualBox Guest Additions, which are often installed in virtualized environments. The presence of such a string in network traffic can indicate that a system is a virtual machine, which attackers or malware might query to detect if they are running in a sandbox or virtualized analysis environment. This detection is categorized as 'trojan-activity' and is related to discovery tactics.
This rule detects potential session cookie theft and bulk cookie exfiltration by monitoring HTTP traffic for large cookie sizes (greater than 500 bytes) being sent from the internal network to external servers. A threshold of 20 such events within 60 seconds from a single source IP triggers the alert, indicating suspicious activity that could be related to an attacker exfiltrating stolen session cookies.
This rule detects a PowerShell Empire C2 beacon pattern over HTTP. Specifically, it looks for HTTP POST requests to '/index.jsp' where the client body contains a base64-like encoded string of at least 200 characters, indicated by the PCRE pattern. This pattern is characteristic of how PowerShell Empire agents communicate with their command and control server.
This rule detects default beacon check-ins from Cobalt Strike. It specifically looks for HTTP POST requests to the URI '/submit.php' with a User-Agent string matching the pattern 'Mozilla/5.0 (compatible; MSIE [0-9]/'. This combination of indicators is characteristic of the default configuration of Cobalt Strike's beacon communication.
MSSQL Database DROP Destruction
Suricata
This rule detects attempts to drop a database on an MSSQL server. It specifically looks for the string "DROP DATABASE" in TCP traffic destined for port 1433 (the default MSSQL port). This activity is indicative of data destruction or sabotage.
This rule detects a mass account lockout pattern over LDAP. It triggers an alert if 20 or more LDAP requests containing the string "lockoutTime" are observed from a single destination IP address within a 60-second window. This behavior is indicative of an attacker attempting to lock out multiple user accounts, potentially as a denial-of-service attack or to facilitate other attacks like password spraying by preventing legitimate users from logging in.
This rule detects a TFTP (Trivial File Transfer Protocol) firmware upload attempt where the data size is greater than 10000 bytes. This could indicate an attempt to corrupt or replace the firmware on a device, potentially leading to denial of service or unauthorized control. The rule specifically looks for UDP traffic on port 69 (TFTP) with a specific content pattern and a large data size.
This rule detects HTTP requests where the User-Agent header appears to be faked or malformed. Specifically, it looks for a User-Agent string that starts with 'Mozilla/5.0' followed by an opening parenthesis, and then contains at least 200 characters before a closing parenthesis. This pattern is often used by malicious actors to evade detection by making their User-Agent string unusually long and potentially obfuscated, while still mimicking a common browser prefix.
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a URI containing "keys" (case-insensitive) and a data size greater than 500 bytes. This combination suggests a large amount of data, possibly keystrokes, being sent to a server.
This rule detects DNS queries to 'discord.com' with a high frequency (20 queries within 60 seconds from the same source IP). This behavior is indicative of Command and Control (C2) activity leveraging Discord webhooks, as described in MITRE ATT&CK technique T1102. Attackers often use legitimate services like Discord for C2 to blend in with normal network traffic and evade detection.
This rule detects non-HTTP traffic on TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP. This could indicate command and control (C2) activity attempting to blend in with legitimate HTTPS traffic.
This rule detects potential Command and Control (C2) communication over SMTP (port 25). It specifically looks for TCP traffic originating from the home network to any destination on port 25, indicating an established connection. A threshold of 10 connections within 300 seconds from the same source IP is set to reduce false positives, suggesting a high volume of SMTP activity that could be indicative of C2.
This rule detects a pattern of mass file deletion over SMB (Server Message Block) protocol. It triggers an alert if 100 or more SMB packets containing specific content (likely indicating file operations) are observed within a 10-second window, originating from the same source IP address and destined for port 445 (SMB). This behavior is often associated with ransomware or other malicious activities aiming to impact data availability.
This rule detects attempts to bypass Windows User Account Control (UAC) elevation prompts by leveraging specific COM objects. It looks for HTTP traffic containing the strings "ICMLuaUtil" and "ShellExec" (case-insensitive) in the file data, which are indicative of this technique. This method is often used by malware to gain elevated privileges without user interaction.
This rule detects HTTP network connections to TeamViewer domains, specifically 'teamviewer.com' or 'router.teamviewer.com'. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This behavior is indicative of TeamViewer being used for persistent command and control (C2) activities, often associated with trojan activity.
This rule detects attempts to retrieve C2 configuration from Pastebin, specifically looking for HTTP requests to 'pastebin.com' that include '/raw/' in the URI. It uses a threshold of 5 occurrences within 300 seconds from the same source to reduce false positives.
Page 81 of 93