Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects attempts to fingerprint a browser's configuration using JavaScript by looking for the presence of 'navigator.userAgent' and 'navigator.platform' within HTTP response data. This technique is often used during reconnaissance phases by attackers to gather information about a target's browser environment.
This rule detects HTTP requests to 'api.shodan.io', indicating a potential query to the Shodan Internet Scan Database. This activity could be part of reconnaissance efforts by an attacker or security researcher to gather information about internet-connected devices and services.
This rule detects HTTP requests to known Certificate Transparency (CT) log query services such as crt.sh, censys.io, and certspotter.com. These services are often used by attackers during the reconnaissance phase to gather information about an organization's SSL certificates and subdomains.
This rule detects HTTP requests to VirusTotal's domain lookup service (www.virustotal.com/domain/). This activity is often associated with passive DNS lookups, which can be part of reconnaissance efforts by attackers or security researchers to gather information about a target's infrastructure.
This rule detects HTTP requests made to the SecurityTrails API (api.securitytrails.com). SecurityTrails is a service that provides access to passive DNS databases and other domain-related intelligence. Such queries can indicate reconnaissance activity by an attacker or security researcher gathering information about a target domain.
This rule detects HTTP requests where the User-Agent header contains the string "feroxbuster" (case-insensitive). Feroxbuster is a command-line tool used for content discovery on web servers, often employed in penetration testing or reconnaissance phases to find hidden directories and files. Detecting its User-Agent can indicate an active directory brute-force or content discovery scan against the network.
This rule detects potential business partner directory scraping by monitoring HTTP requests to the server. It triggers an alert if a client makes 15 or more requests containing 'partners' (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated tool attempting to enumerate or collect information about an organization's business partners.
This rule detects HTTP requests to known threat intelligence portals associated with dark web monitoring. It specifically looks for hostnames containing 'intel471', 'kela.io', 'recordedfuture', or 'flashpoint'. This could indicate an analyst or system accessing threat intelligence, or potentially an adversary performing reconnaissance.
This rule detects attempts to harvest credentials using a fake Microsoft login page. It triggers when HTTP traffic from the server to the client contains both "microsoftonline" and "password" in the file data, and the HTTP host is an IP address. This combination suggests a phishing attempt where a malicious server is impersonating a Microsoft login page to capture user credentials.
This rule detects access to known dark web credential markets by inspecting HTTP host headers for specific domain patterns. It triggers an alert if a client on the home network attempts to connect to 'genesis.market', 'russianmarket', or '2easy.shop'. This indicates potential reconnaissance or direct access to platforms where stolen credentials are traded.
This rule detects HTTP traffic to 'zoominfo.com' with a high frequency (15 times in 60 seconds from the same source IP). This behavior is indicative of automated data harvesting or reconnaissance activities targeting corporate information.
This rule detects attempts to download raw payload files (PowerShell scripts, executables, DLLs, batch files, VBScripts, Python scripts, or shell scripts) from raw.githubusercontent.com. This activity is often associated with adversaries attempting to retrieve malicious tools or scripts from code repositories.
This rule detects HTTP requests to 'crt.sh', a Certificate Transparency log search engine. Such requests can indicate an adversary performing reconnaissance to gather information about an organization's digital certificates and domains.
This Suricata rule detects potential steganography payloads embedded within image downloads. It specifically looks for the JPEG file signature `FF D8 FF` within the first 3 bytes of an HTTP response, combined with a large file size (greater than 500KB). The rule also includes a threshold to prevent excessive alerts, triggering if 5 such downloads occur from the same destination within 60 seconds. This behavior is indicative of an attempt to hide malicious code or data within seemingly innocuous image files to evade detection.
Obfuscated VBScript Download
Suricata
This rule detects the download of potentially obfuscated VBScript files over HTTP. It specifically looks for the string 'Chr(' repeated multiple times within the first 200 bytes of the file data, which is a common obfuscation technique used in malicious VBScripts to hide their true content.
This rule detects attempts to download known exploit framework tools such as Metasploit, Cobalt Strike, Empire, Covenant, Sliver, or Havoc by inspecting HTTP URI content. The detection is based on case-insensitive pattern matching within the HTTP URI.
Payload Download from GitLab Raw
Suricata
This rule detects attempts to download executable or script files (PowerShell, executable, DLL, shell script, Python script) from the 'raw' content section of gitlab.com. This behavior is often associated with adversaries staging or retrieving malicious payloads.
This rule detects attempts to exploit the Shellshock Bash vulnerability via CGI. It specifically looks for HTTP requests containing the string "() {" in the header, which is characteristic of the Shellshock exploit payload used to inject arbitrary commands.
This Suricata rule detects HTTP requests containing 'VBoxService' in the URI. This string is associated with VirtualBox Guest Additions, which are often installed in virtualized environments. The presence of such a string in network traffic can indicate that a system is a virtual machine, which attackers or malware might query to detect if they are running in a sandbox or virtualized analysis environment. This detection is categorized as 'trojan-activity' and is related to discovery tactics.
This rule detects HTTP requests to the Azure Instance Metadata Service (IMDS) IP address (169.254.169.254) with the URI containing 'metadata/instance'. This activity indicates an attempt to discover information about the Azure virtual machine instance, which can be a legitimate administrative action or an adversary attempting to collect credentials and other sensitive data.
This rule detects potential session cookie theft and bulk cookie exfiltration by monitoring HTTP traffic for large cookie sizes (greater than 500 bytes) being sent from the internal network to external servers. A threshold of 20 such events within 60 seconds from a single source IP triggers the alert, indicating suspicious activity that could be related to an attacker exfiltrating stolen session cookies.
Page 94 of 116