Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects when a file is written to a remote Windows Startup folder via Server Message Block (SMB). The rule specifically looks for SMB traffic containing the string "Startup" and "\AppData\Roaming\Microsoft\Windows\" (case-insensitive) in the flow to the server. This activity is often associated with persistence mechanisms where malware or an attacker attempts to execute code automatically upon system startup.
This rule detects attempts to download a payload that contains an MSBuild inline task. It specifically looks for HTTP traffic (flow:to_client,established) containing the case-insensitive strings "<UsingTask" and "TaskFactory" within the file data. This pattern is indicative of an attacker attempting to leverage MSBuild's inline task functionality to execute arbitrary code, often as part of a larger attack chain for code execution or persistence.
This rule detects HTTP POST requests that contain the string "creds" in the URI and have a data size greater than 200 bytes. This pattern is indicative of potential browser credential exfiltration, where an attacker or malicious software attempts to send stolen credentials to a remote server.
This rule detects the download of files with names indicative of 'Potato' privilege escalation tools. It specifically looks for HTTP URI patterns containing 'potato' preceded by terms like 'sweet', 'juicy', 'rogue', 'bad', or 'print', case-insensitively. The detection is triggered on HTTP traffic flowing from the server to the client.
This rule detects attempts to drop a DLL file to a network share, specifically targeting the 'ADMIN$' share, which could indicate a DLL hijacking attempt. It monitors SMB traffic on port 445 for established connections and looks for content containing '.dll' and 'ADMIN$' (case-insensitive).
This Suricata rule detects potential data exfiltration of password store information over HTTP. It specifically looks for HTTP POST requests where the client body contains both the words "password" and "username" (case-insensitive) and the body size is greater than 1000 bytes. This pattern suggests an attempt to send sensitive credential data from a compromised system to a remote server.
Cobalt Strike DNS Beacon Pattern
Suricata
This rule detects a specific pattern associated with Cobalt Strike DNS beacons. It looks for HTTP requests where the URI contains '/updates' and the User-Agent header is 'Mozilla/4.0'. This combination of indicators is often used by Cobalt Strike for command and control communication.
This rule detects attempts to drop executable files (.exe) into shared network folders (specifically those containing '\share\') over SMB (Server Message Block) protocol. This activity is indicative of an attacker attempting to move tools or malware laterally within a network.
This rule detects a pattern indicative of ransomware encrypting files over SMB. It specifically looks for TCP traffic on port 445 (SMB) within the home network, containing the byte sequence '|FF|SMB'. A threshold of 500 such events from a single source IP within 30 seconds triggers the alert, classifying it as trojan activity.
XOR Encoded C2 Traffic Pattern
Suricata
This rule detects HTTP client body traffic that appears to be XOR encoded, characterized by a long sequence of non-printable ASCII characters (bytes 0x01-0x1f and 0x7f-0xff) of at least 50 characters. This pattern is often indicative of Command and Control (C2) communication used by malware to evade detection.
Bitsadmin Tool Transfer Download
Suricata
This rule detects the use of the 'bitsadmin' tool in HTTP user agent strings during a file transfer download. Bitsadmin is a legitimate Windows command-line tool used to create, manage, and monitor download and upload jobs, but it is frequently abused by adversaries for command and control, data transfer, and persistence.
This rule detects HTTP requests where the URI contains the string "-EncodedCommand" case-insensitively. This pattern is commonly associated with PowerShell commands that are base64 encoded, often used by attackers to obfuscate malicious scripts. The rule specifically looks for this string in the HTTP URI, indicating an attempt to download or execute an encoded PowerShell command.
This rule detects HTTP requests that contain patterns indicative of a PowerShell download cradle. Specifically, it looks for 'powershell' and 'IEX' (Invoke-Expression) within the HTTP URI, suggesting an attempt to download and execute a script using PowerShell.
This rule detects HTTP downloads of common script file types (PowerShell, VBScript, JavaScript, HTML Application, Batch, Command) from any source to the internal network. This activity is often associated with initial access or execution techniques where adversaries download malicious scripts to a compromised host.
This rule detects HTTP C2 beaconing activity characterized by regular interval GET requests. It specifically looks for 20 GET requests within a 60-second window from the same source IP address to any destination. This pattern is indicative of command and control communication, often used by malware to check in with its operators.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.
This rule detects HTTP requests where the URI contains the string "ransom" (case-insensitive). This pattern is indicative of potential ransomware command and control (C2) check-ins, as ransomware often uses terms like 'ransom' in its communication with C2 servers.
This rule detects bulk account deletion attempts via LDAP. It triggers when multiple LDAP requests (at least 5 within 30 seconds from the same source IP) are observed on port 389, containing both 'userAccountControl' and 'delete' keywords, indicating an attempt to modify user account control attributes to disable or delete accounts.
This rule detects potential command and control (C2) communication over SMTP by looking for repeated 'EHLO' commands within a short timeframe from the same source IP address. The threshold is set to trigger if 10 'EHLO' commands are observed within 300 seconds (5 minutes) from a single source.
This rule detects potential command and control (C2) beaconing activity over HTTP. It specifically looks for HTTP POST requests with a content size between 50 and 300 bytes that occur at a regular interval (15 times in 60 seconds) from a single source IP address. This pattern is often indicative of malware communicating with a C2 server.
This rule detects attempts to modify stored data within a MySQL database, specifically looking for 'UPDATE' and 'WHERE' clauses in TCP traffic directed to the MySQL default port (3306). It triggers an alert if 50 such events are observed from the same source IP within a 30-second window, indicating potential malicious activity aimed at data integrity compromise.
Page 84 of 93