Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects HTTP requests to known underground forums (nulled.to, hackforums.net, ogusers) via a clearnet proxy. It specifically looks for these hostnames in HTTP traffic.
This rule detects potential reconnaissance activity involving scraping LinkedIn company overview pages. It triggers when a client makes 10 or more HTTP requests to 'linkedin.com' with a URI containing '/about/' within a 60-second window. This pattern suggests automated or rapid collection of public company information from LinkedIn.
This rule detects repeated access attempts to web pages containing 'annual-report' in the URI. It triggers an alert if a single source IP makes 5 such requests within a 30-second window. This could indicate reconnaissance activity by an attacker looking for publicly available financial information.
This rule detects automated collection of organizational profile information characterized by a high rate of HTTP GET requests originating from specific user agents commonly associated with web scraping tools. It triggers an alert if a source IP makes 30 or more HTTP GET requests within a 20-second window, using user agents like 'python-requests', 'scrapy', 'curl', 'wget', or 'Go-http-client'. This behavior is indicative of reconnaissance activities, potentially for data exfiltration or vulnerability scanning.
This rule detects the use of the SQLMap automated SQL injection tool by identifying the string "sqlmap" in the HTTP User-Agent header of network traffic. It specifically looks for traffic flowing to the server on established connections.
Wfuzz Directory Scanner Detected
Suricata
This rule detects the use of Wfuzz, a web fuzzer, by identifying the 'Wfuzz' string in the HTTP User-Agent header. This activity is typically associated with reconnaissance, as attackers use such tools to discover directories, files, and other web application structures.
Nikto Web Scanner Detected
Suricata
This rule detects the use of the Nikto web scanner by identifying the 'Nikto' string in the HTTP User-Agent header. Nikto is a common open-source web server scanner that performs comprehensive tests against web servers for multiple items, including dangerous files/CGIs, outdated server software, and other problems. Detection of Nikto typically indicates reconnaissance activity against a web application or server.
This rule detects attempts to fingerprint web applications by identifying the 'WhatWeb' string in the HTTP User-Agent header. WhatWeb is a web application scanner that identifies technologies used by websites, which can be an indicator of reconnaissance activity.
This rule detects HTTP responses from a C2 beacon that contain the keywords "kill" and "process" (case-insensitive) within the URI. This pattern suggests a command being sent from the command and control server to the client to terminate a process, potentially an antivirus process, as part of defense evasion tactics.
This rule detects HTTP traffic where the URI contains both 'disable' and 'defender' (case-insensitive). This pattern suggests an attempt to disable security tools, specifically Windows Defender, via an HTTP command. The flow is set to 'to_client,established', indicating the response from a server to a client within an established connection.
This rule detects the download of a COM scriptlet (.sct file) over HTTP that contains XML and the keyword 'scriptlet'. This behavior is characteristic of the 'Squiblydoo' technique, which abuses legitimate Windows binaries like Regsvr32 to execute arbitrary code, often for defense evasion.
This rule detects HTTP traffic where the User-Agent header contains the string 'CertUtil' (case-insensitive). This pattern is often associated with adversaries using the Windows built-in utility CertUtil to download malicious payloads, a common technique for defense evasion.
This rule detects HTTP downloads where the file is disguised as an image (e.g., .jpg, .png) but its content starts with 'MZ', indicating it's a Windows executable. This is a common technique used by adversaries to bypass security measures that might block executable downloads but allow image files.
This rule detects attempts to download a payload that contains an MSBuild inline task. It specifically looks for HTTP traffic (flow:to_client,established) containing the case-insensitive strings "<UsingTask" and "TaskFactory" within the file data. This pattern is indicative of an attacker attempting to leverage MSBuild's inline task functionality to execute arbitrary code, often as part of a larger attack chain for code execution or persistence.
This rule detects HTTP POST requests that contain the string "creds" in the URI and have a data size greater than 200 bytes. This pattern is indicative of potential browser credential exfiltration, where an attacker or malicious software attempts to send stolen credentials to a remote server.
This rule detects the download of files with names indicative of 'Potato' privilege escalation tools. It specifically looks for HTTP URI patterns containing 'potato' preceded by terms like 'sweet', 'juicy', 'rogue', 'bad', or 'print', case-insensitively. The detection is triggered on HTTP traffic flowing from the server to the client.
This rule detects attempts to access directory listings on a web server via HTTP. It specifically looks for HTTP responses containing the string "Index of /" in the file data, which is a common indicator of an exposed directory listing. This exposure can allow attackers to discover sensitive files and directories on the server.
This rule detects HTTP requests attempting to access the AWS EC2 Instance Metadata service, specifically targeting the 'latest/meta-data' endpoint. This service, typically found at the IP address 169.254.169.254, provides information about the running EC2 instance, including credentials and other sensitive data. Unauthorized access to this endpoint can indicate an attacker attempting to gain further access or information within an AWS environment.
This Suricata rule detects potential data exfiltration of password store information over HTTP. It specifically looks for HTTP POST requests where the client body contains both the words "password" and "username" (case-insensitive) and the body size is greater than 1000 bytes. This pattern suggests an attempt to send sensitive credential data from a compromised system to a remote server.
Cobalt Strike DNS Beacon Pattern
Suricata
This rule detects a specific pattern associated with Cobalt Strike DNS beacons. It looks for HTTP requests where the URI contains '/updates' and the User-Agent header is 'Mozilla/4.0'. This combination of indicators is often used by Cobalt Strike for command and control communication.
This rule detects large HTTP POST requests containing GZIP compressed data (identified by the magic bytes '|1F 8B|') with a size greater than 100,000 bytes. This behavior is indicative of possible data staging or exfiltration, where an attacker might compress and upload sensitive data from a compromised system.
Page 99 of 116