Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects potential command and control (C2) channel activity by identifying HTTP requests where the URI contains specific keywords commonly associated with C2 infrastructure switching or staging. The keywords include 'stage2', 's2', 'next', 'pivot', and 'relay'. This indicates an attacker might be moving to a new phase of their operation or redirecting C2 communications.
This rule detects potential bidirectional command and control (C2) activity leveraging Discord webhooks. It specifically looks for HTTP POST requests to 'discord.com' with the URI containing '/api/webhooks/'. A threshold of 5 such requests within 60 seconds from the same source IP is set to reduce false positives and indicate sustained communication, characteristic of C2.
This rule detects access to websites or services that are commonly associated with botnet rental, stresser, or DDoS-for-hire services. It specifically looks for HTTP requests where the host header contains keywords like 'booter', 'stresser', or 'ddoser' (case-insensitive). This indicates a potential policy violation where an internal user might be attempting to utilize or research such services.
This rule detects HTTP requests where the 'Host' header matches patterns commonly associated with serverless function domains, specifically AWS Lambda URLs, Azure Websites, and Google Cloud Functions. The rule is designed to identify potential command and control (C2) infrastructure utilizing serverless platforms. It triggers an alert if 10 such requests are observed from a single source IP within a 60-second window.
This rule detects HTTP traffic where the 'Host' header contains 'workers.dev'. This domain is associated with Cloudflare Workers, which can be used by attackers to deploy attack infrastructure such as command and control (C2) servers, phishing pages, or data exfiltration points. The rule is configured to trigger a threshold alert if 10 such connections are observed from a single source IP within 60 seconds, indicating potential automated activity or repeated attempts to access or deploy malicious worker scripts.
This rule detects attempts to create or access disposable email accounts by monitoring HTTP traffic for specific keywords in the HTTP host header. It triggers an alert if it observes 5 instances of these keywords from the same source IP within a 60-second window. The keywords include common disposable email service domains like 'guerrillamail', 'tempmail', 'mailinator', and '10minutemail'.
This rule detects the download of a potential post-exploitation framework binary over HTTP. It looks for HTTP responses containing the 'MZ' magic bytes (indicating a Windows executable) and specific keywords like 'beacon', 'agent', 'implant', 'payload', or 'stager' in the HTTP URI. This combination suggests an attempt to deliver malicious tools to a compromised system.
This rule detects the download of known exploit kits by inspecting HTTP URI patterns. It specifically looks for the strings 'rig', 'fallout', 'spelevo', or 'purplefox' followed by 'kit' (case-insensitive) within the HTTP URI. The detection is triggered on traffic flowing to the client that is part of an established connection.
This rule detects HTTP responses that contain hidden keywords, a technique often used in SEO poisoning. It specifically looks for HTML content with 'display:none' and 'font-size:0' which are common methods to hide text from users while still being parsed by search engine crawlers.
This rule detects HTTP network connections to common Cloud Virtual Private Server (VPS) providers (DigitalOcean, Vultr, Linode, Hetzner) where the URI content includes the word 'create'. This combination suggests an attempt to set up new infrastructure, potentially for malicious purposes, aligning with resource development tactics.
This rule detects potential email directory enumeration attempts by monitoring HTTP requests. It triggers when a client sends 10 or more HTTP requests within 30 seconds to the server, where each request URI contains both an '@' symbol and '.com'. This pattern is indicative of an attacker trying to guess valid email addresses on a domain.
This rule detects a rapid succession of HTTP POST requests to a URI containing 'login' from the same source IP address, indicating a potential credential stuffing or brute-force attack. It triggers an alert if 20 such attempts occur within a 30-second window.
Exposed Git Repository Discovery
Suricata
This rule detects attempts to discover exposed Git repositories on a web server. It triggers when an HTTP request URI contains the string "/.git/", indicating a client is probing for the presence of a Git repository's internal structure. This is a common reconnaissance technique used by attackers to find sensitive information or source code.
WHOIS Database API Bulk Query
Suricata
This rule detects HTTP requests to known WHOIS database API services (whoisxmlapi.com, whoisfreaks.com, whoapi.com). Such activity could indicate an attempt to perform bulk reconnaissance on domains or IP addresses, potentially for malicious purposes like phishing, infrastructure mapping, or identifying targets.
This rule detects the presence of the Acunetix Web Vulnerability Scanner based on its unique User-Agent string in HTTP traffic. It specifically looks for the case-insensitive string "acunetix" within the HTTP User-Agent header in traffic flowing from the internal network to an external server.
This rule detects the download of remote support tools such as AnyDesk, TeamViewer, Atera, Splashtop, and ConnectWise. The detection is based on HTTP URI patterns that match these tool names. This activity is often associated with phone scams where attackers trick users into installing remote access software, giving the attackers control over their systems.
This rule detects potential reverse proxy phishing pages by looking for HTTP URI requests that contain the keywords 'verify', 'account', and 'secure' (case-insensitive). The presence of these keywords in the URI of an HTTP request, particularly when combined, can indicate an attempt to mimic legitimate login or account verification pages, often used in phishing attacks.
This rule detects HTTP traffic where the URI contains common URL shortener domains (bit.ly, tinyurl, t.co, ow.ly, is.gd) and also contains the string "login" (case-insensitive). This combination is often indicative of phishing attempts that use URL shorteners to obscure malicious links, leading users to fake login pages.
This rule detects network connections to known threat intelligence vendor portals. It specifically looks for HTTP traffic where the host header matches one of the specified domains: intel471.com, ke-la.com, recordedfuture.com, or flashpoint.io. This could indicate an analyst or automated system accessing threat intelligence resources.
This rule detects enumeration of organization profiles on Crunchbase.com by monitoring HTTP traffic for connections to 'crunchbase.com' with a high frequency (15 times in 60 seconds) from a single source IP address. This behavior is indicative of a network scan or automated data collection activity.
This rule detects potential reconnaissance activity targeting investor relations pages on a web server. It triggers when a client makes 10 or more HTTP requests containing the word "investor" (case-insensitive) in the URI within a 30-second window. This could indicate an attacker attempting to gather information about a company's financial status, ownership, or other sensitive details often found on investor relations sections of websites.
Page 88 of 116