Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects network traffic on port 445 (SMB) containing the strings "cacls" and "/G Everyone:F" (case-insensitive). This combination suggests an attempt to weaken folder permissions on a Windows system by granting full control to 'Everyone' using the `cacls` command, potentially via remote registry access or a similar mechanism that transmits the command over the network.
This rule detects attempts to copy the NTDS.dit Active Directory database file over SMB (Server Message Block) to a server. The rule specifically looks for the string "ntds.dit" within TCP traffic destined for port 445 (SMB). This activity is highly suspicious as the NTDS.dit file contains critical Active Directory information, including hashed user credentials, and its exfiltration is a common technique used by attackers for credential dumping.
This rule detects attempts to read AutoLogon credentials from the Windows Registry over the network, specifically targeting SMB (port 445) traffic. It looks for the strings 'DefaultPassword' and 'Winlogon' in a case-insensitive manner within the TCP payload, indicating a potential attempt to extract stored credentials used for automatic login.
This rule detects the creation of a systemd timer via a remote SSH session. It specifically looks for TCP traffic on port 22 (SSH) containing the commands 'systemctl enable' and '.timer' (case-insensitive), indicating an attempt to enable a systemd timer unit.
This rule detects potential macOS XPC Service abuse via remote SSH. Specifically, it looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "launchctl" and "submit" (case-insensitive). This combination suggests an attempt to use the launchctl command to submit a job, potentially exploiting XPC services, over an SSH connection.
This rule detects an attempt to access the ESXi direct SSH shell by looking for the 'vim-cmd' string in TCP traffic directed to port 22 (SSH) on the home network. This indicates an administrative command being executed directly on an ESXi host via SSH.
This rule detects attempts to enable the ESXi Host Shell via the vCenter Web API. It specifically looks for HTTP requests to the '/api/vcenter/host' URI containing the word 'shell' in the client body, indicating a potential administrative action to enable shell access on an ESXi host.
This rule detects network traffic destined for TCP port 902 on the home network, which is commonly used for ESXi vSphere management. The rule specifically looks for established TCP connections to this port and triggers an alert if five such connections are observed from the same source within a 30-second window. This could indicate management activity or potential reconnaissance/attack against ESXi hosts.
This rule detects network traffic indicative of a domain account being used for lateral movement via SMB. It specifically looks for NTLMSSP authentication within SMB traffic directed to port 445 on the home network, containing the string 'domain' (case-insensitive). A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, suggesting a potential brute-force or rapid access attempt.
This rule detects network connections from devices that might be Raspberry Pis or Hak5 devices, based on their HTTP User-Agent string. Specifically, it looks for User-Agents containing 'python-requests' or 'curl/' followed by a digit, indicating the use of common command-line tools or Python libraries for making HTTP requests. The rule is configured to trigger an alert if 10 such connections are observed from the same source IP within 10 seconds, suggesting automated or frequent activity.
This rule detects a network scan targeting TCP port 4444 on the home network. It specifically looks for SYN packets (flags:S) indicating an attempt to establish a connection. A threshold of 5 connection attempts from the same source within 60 seconds triggers the alert, suggesting a port scan activity. Port 4444 is often associated with security appliance management interfaces or backdoors, making probes to this port suspicious.
This rule detects network host discovery attempts using a TCP SYN sweep. It triggers when a source IP sends 30 or more TCP SYN packets (indicated by the 'flags:S' option) to any destination on the HOME_NET within a 10-second window. This behavior is characteristic of an attacker attempting to identify active hosts on a network by sending SYN packets and observing which hosts respond with a SYN-ACK.
Stealth NULL Scan Port Probe
Suricata
This rule detects a Stealth NULL Scan Port Probe. A NULL scan is a type of port scan where all the TCP flags (URG, ACK, PSH, RST, SYN, FIN) are turned off. If the target port is closed, the target system should respond with an RST packet. If the port is open, the target system should not respond at all. This behavior can be used by attackers to map out open ports on a system while attempting to evade detection by some firewalls or intrusion detection systems that might be configured to only look for SYN packets.
This rule detects attempts to exploit the Zerologon (CVE-2020-1472) vulnerability, a critical privilege escalation flaw in Microsoft's Netlogon Remote Protocol. It specifically looks for network traffic on TCP port 445 (SMB) containing the 'NetrServerAuthenticate3' function call with a specific sequence of null bytes, which is indicative of an unauthenticated Netlogon session setup without signing and sealing, a key characteristic of the Zerologon exploit.
This rule detects attempts to remotely install Windows services over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "svcctl" and "CreateService" in a case-insensitive manner, indicating a service control request to create a new service. This activity is often associated with adversaries establishing persistence on a compromised system.
This rule detects a possible port knocking sequence, which is a method of externally opening ports on a firewall by generating a sequence of connection attempts to a set of closed ports. The rule specifically looks for 5 TCP SYN packets from the same source IP within a 5-second window to any port on the home network, indicating a potential port knocking attempt.
This rule detects large internal data transfers within the network. Specifically, it triggers when the data size of an established TCP flow exceeds 65000 bytes. A threshold is applied, alerting if 50 such transfers occur from the same source within a 60-second window. This behavior is often associated with internal data staging, a technique used by attackers to collect and consolidate data before exfiltration.
This rule detects attempts to enumerate SMB network shares. It triggers when TCP traffic is directed to port 445 (SMB) on the home network, contains the SMB protocol signature, and specifically includes the string 'NetShareEnum' (case-insensitive). A threshold of 5 occurrences within 60 seconds from the same source IP is applied to reduce false positives.
This rule detects the execution of a VDSO hijacking payload over an SSH connection. It specifically looks for the case-insensitive strings "vdso" and "mmap" within the TCP payload of an established SSH session, indicating an attempt to manipulate the Virtual Dynamic Shared Object (VDSO) for privilege escalation or other malicious purposes.
This rule detects network traffic containing the string "/etc/sudoers" over TCP port 22 (SSH). This could indicate an attempt to modify the sudoers file for privilege escalation, as the sudoers file controls which users can execute commands with superuser privileges.
This rule detects attempts to manipulate the sudo timestamp cache by looking for repeated 'sudo -n' commands within a short timeframe. The 'sudo -n' command allows sudo to run a command without prompting for a password, which can be abused by an attacker to maintain sudo privileges or bypass re-authentication if they have already compromised a user's session. The thresholding mechanism (10 times in 30 seconds from the same source IP) aims to reduce false positives from legitimate, infrequent uses of 'sudo -n' and focus on potential automated or rapid attempts to interact with sudo without password prompts, possibly to keep the timestamp alive or to quickly execute multiple commands.
Page 28 of 42