Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects attempts to modify SSH authorized_keys files over a network connection, which could indicate an attacker establishing backdoor access. It specifically looks for the string "authorized_keys" within TCP traffic destined for port 22 (SSH).
This rule detects attempts to push potentially malicious container images to an internal registry. It specifically looks for HTTP POST requests to '/v2/' and '/blobs/uploads/' URIs, indicating an image layer upload, with a data size greater than 100KB. This behavior could be indicative of an attacker attempting to establish persistence or introduce malicious code into the container environment.
This rule detects potential DLL hijacking attempts targeting Terminal Services (RDP) by looking for the string "termsrv.dll" within TCP traffic destined for port 3389 (RDP). This could indicate an attacker attempting to load a malicious DLL in place of the legitimate termsrv.dll to maintain persistence or execute arbitrary code.
This rule detects network traffic indicating the installation of a Transport Agent on an Exchange server. It specifically looks for the strings "TransportAgent" and "Install-TransportAgent" in TCP traffic directed to port 25 of the home network, suggesting a potential malicious or unauthorized installation of an Exchange Transport Agent.
This rule detects attempts to create a stored procedure in a Microsoft SQL Server database that includes the 'xp_cmdshell' extended stored procedure. 'xp_cmdshell' allows execution of operating system commands directly from SQL Server, and its use in a newly created stored procedure can indicate an attacker establishing persistence or attempting to execute arbitrary commands on the underlying system.
This rule detects the delivery of a malicious Outlook form script over HTTP. It specifically looks for HTTP traffic flowing to the client that contains the strings "IPM.Note", "Script", and "VBScript" within the file data, indicating an attempt to deliver a VBScript-based Outlook form.
This rule detects the remote creation of a WMI event subscription, specifically looking for '__EventFilter' and 'CommandLineEventConsumer' within TCP traffic on port 445. This activity is often associated with persistence mechanisms used by attackers.
This rule detects attempts to modify Cisco router firmware using ROMMONkit. It specifically looks for TCP traffic to the HOME_NET on port 23 (Telnet) containing the case-insensitive strings "rommon" and "tftpdnld". This combination suggests an attempt to interact with the router's ROM Monitor mode for firmware manipulation, often associated with malicious activities like installing backdoors or persistent malware.
This rule detects network traffic on port 445 (SMB) containing the strings "LSASS" and "AddDll" (case-insensitive). This combination of strings suggests an attempt to register a malicious DLL with the Local Security Authority Subsystem Service (LSASS) for persistence, a technique often used by malware to maintain access on a compromised system. The flow is set to 'to_server' and 'established', indicating an outgoing connection from the monitored network to a server, and that the TCP connection has been successfully established.
This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "icacls" and "grant" (case-insensitive). This combination suggests an attempt to modify file or directory permissions, specifically granting permissions, which could be indicative of an attacker exploiting a service binary file permission weakness to establish persistence or elevate privileges. The rule is triggered when these strings are observed in traffic flowing to the server.
This rule detects the deployment of a potentially malicious middleware component on an application server. It specifically looks for HTTP POST requests to port 8080 with a URI containing 'deploy' (case-insensitive) and a data size greater than 10000 bytes. This pattern is indicative of a large payload being sent to deploy an application or component, which could be malicious in nature.
This rule detects HTTP requests that contain both 'config' and 'lock' in the URI, suggesting an attempt to access or manipulate configuration files that might be locked, potentially indicating an exclusive lock on a security tool's configuration file. The rule is classified as 'trojan-activity'.
This rule detects attempts to write shell event hook scripts, specifically those using 'trap' and 'SIGHUP', over an SSH connection. This activity is often associated with persistence mechanisms where an attacker sets up a script to execute upon certain shell signals, such as a hangup signal, to maintain access or execute malicious code.
This rule detects network traffic indicative of a remote WMI event subscription being registered. Specifically, it looks for TCP traffic on port 135 (typically used by Microsoft RPC and DCOM, which WMI can leverage) directed to the home network, containing the string "__EventConsumer" case-insensitively. This activity can be a sign of persistence mechanisms being established by attackers.
This rule detects when a system daemon configuration file, specifically one containing ".service" in its URI and "[Service]" in its content, is delivered via HTTP from any source to the internal network. This could indicate an attempt to establish persistence or modify system services on a compromised host.
This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.
This rule detects the download of a Python script that appears to be a reverse shell. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "import socket" and "connect(" within the file data, case-insensitive. These strings are common indicators of Python code attempting to establish a network connection, often used in reverse shell implementations.
This rule detects the download of a potentially malicious LNK shortcut file over HTTP. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".lnk" (nocase) and the byte sequence "|4C 00 00 00|" at the beginning of the file data (depth:4), which is characteristic of an LNK file header. This activity is often associated with initial access or execution techniques where attackers use shortcut files to deliver malware or execute malicious commands.
This rule detects when a user clicks on a malicious link, indicated by a referrer from common email/webmail services (mail., webmail., outlook., gmail.), and the subsequent HTTP response contains a Windows executable (MZ header). This suggests a drive-by download attempt or a user being tricked into downloading malware after clicking a phishing link.
This rule detects the delivery of a malicious DLL (Dynamic Link Library) file via HTTP download. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".dll" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This combination suggests a DLL being downloaded to a client system, which could be part of a malware delivery chain.
Page 82 of 93