Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects attempts to access Kubernetes secret objects via the Kubernetes API. It specifically looks for HTTP requests to the '/api/v1/namespaces/' path followed by '/secrets' on port 8080. This activity could indicate an attacker attempting to exfiltrate sensitive information stored in Kubernetes secrets.
This rule detects attempts to hijack the clipboard on a web page by identifying HTTP responses (flow:to_client) that contain both 'clipboardData' and 'setData' (case-insensitive) in the file data. This combination of keywords suggests a script attempting to read from and write to the client's clipboard, which is a common technique for clipboard hijacking.
This rule detects HTTP traffic where a shortened URL (from services like bit.ly, tinyurl, ow.ly, or t.co) is used in the HTTP referer header, and the HTTP response body contains the 'MZ' magic bytes, indicating a Windows executable file. This combination suggests a malicious redirect leading to the download of a payload, often associated with phishing or drive-by download attacks.
This rule detects the deployment of a new privileged container via the Docker API. It specifically looks for HTTP requests to the '/containers/create' endpoint with 'Privileged' in the client body, indicating an attempt to create a container with elevated privileges. This activity can be indicative of an attacker attempting to gain higher access or persistence within a compromised system by deploying a malicious container.
This rule detects when a 'docker exec' command is run against a running container. It specifically looks for HTTP POST requests to the '/exec' endpoint, which is used by the Docker API to create and start an exec instance inside a container. This activity could indicate an attacker gaining interactive access to a compromised container.
This rule detects the download of a file over HTTP that contains the string "=cmd|" (case-insensitive) within its data. This pattern is indicative of a DDE (Dynamic Data Exchange) formula injection attempt, often used in Office documents to execute commands.
This rule detects attempts by users to download fake software cracks, keygens, activators, patches, or serials from HTTP servers. It specifically looks for HTTP responses containing URIs with keywords like 'crack', 'keygen', 'activator', 'patch', or 'serial' (case-insensitive) and verifies that the downloaded file data starts with 'MZ', indicating a Windows executable. This combination suggests a user is downloading potentially malicious software disguised as a legitimate software cracking tool.
This rule detects the delivery of potentially malicious Flash (.swf) or Java (.jar, .class) files over HTTP. It specifically looks for HTTP responses where the URI ends with one of these extensions and the file data begins with 'MZ', which is the magic number for Windows executable files. This combination suggests an attempt to disguise an executable as a Flash or Java file, likely for exploit delivery.
This rule detects potential browser exploit delivery via heap spray techniques. It specifically looks for a sequence of 12 NOP (No Operation) instructions (0x90) in HTTP response data flowing to a client. This pattern is commonly used in heap spray attacks to prepare memory for shellcode execution.
This rule detects the presence of the string 'document.write(unescape(' in HTTP response bodies. This pattern is commonly used in web-based attacks to inject malicious content, often obfuscated, into legitimate web pages served to clients. The 'flow:to_client,established' indicates that the rule is looking at traffic flowing from the server to the client over an established connection, specifically within the HTTP data payload ('file.data'). The 'nocase' option ensures the detection is case-insensitive.
This rule detects HTTP traffic to 'teams.microsoft.com' with a URI containing '/messages/'. It is designed to identify potential social engineering attempts where malicious links are delivered via Microsoft Teams messages. The rule uses a threshold of 5 occurrences within 60 seconds from the same source IP to reduce false positives.
This rule detects HTTP requests where the 'Host' header contains patterns indicative of free hosting services (000webhost, infinityfree, byethost). These services are often abused by attackers to host malicious infrastructure due to their low cost and ease of setup. The rule specifically looks for these patterns in HTTP traffic flowing from the home network to any destination.
This rule detects a pattern of bulk account registration attempts by monitoring HTTP POST requests to URIs containing 'register'. It triggers an alert if 10 such requests are observed from the same source IP within a 60-second window, indicating potential automated account creation or abuse.
This rule detects attempts to download malware builder tools (such as builders, generators, crypters, or packers) from raw.githubusercontent.com. It specifically looks for HTTP traffic where the host is 'raw.githubusercontent.com' and the URI contains keywords commonly associated with malware development tools.
This rule detects the download of files from raw.githubusercontent.com that contain keywords commonly associated with exploit frameworks, CVEs, or Proof-of-Concepts (PoCs). It specifically looks for 'exploit', 'cve-[0-9]{4}', or 'poc' within the HTTP URI. This activity could indicate an attacker downloading tools or modules for exploitation during resource development or initial access phases.
This rule detects HTTP responses that appear to be phishing pages designed to capture credentials. It specifically looks for HTTP traffic flowing to the client that contains both the words "password" and "submit" (case-insensitive) in the file data, and where the HTTP host is an IP address. This combination suggests a credential input form on a page served from an IP address, which is a common characteristic of phishing attempts.
Offshore VPS Provider API Access
Suricata
This rule detects HTTP traffic to specific domains associated with offshore VPS providers (frantech.ca, serverius.net, combahton.net). This could indicate API access or other interactions with these services, which might be suspicious depending on the environment.
This rule detects HTTP requests to known IP geolocation lookup services (ip-api.com, ipinfo.io, ipgeolocation.io). A high frequency of such requests from a single source IP within a short timeframe (10 requests in 60 seconds) could indicate reconnaissance activity, where an attacker is gathering information about target IP addresses.
This rule detects HTTP requests to github.com that contain sensitive file names or patterns in the URI, such as '.env', 'config.php', 'credentials', 'secrets', or 'api_key'. This activity could indicate an attacker or malicious actor searching for sensitive information exposed in public or private GitHub repositories.
This rule detects attempts to fingerprint WordPress login pages by monitoring HTTP requests for the 'wp-login.php' URI. It triggers an alert if a source IP makes 5 such requests within 60 seconds, indicating a potential reconnaissance activity against WordPress installations.
This rule detects potential credential phishing attempts by identifying HTTP URIs that contain the keywords 'redirect', 'login', and 'microsoft' (case-insensitive). This combination of keywords in a URI is often indicative of a phishing link designed to trick users into providing credentials, especially targeting Microsoft accounts, by redirecting them to a fake login page.
Page 81 of 116