Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
Remote AT Job Scheduled via SMB
Suricata
This rule detects attempts to schedule a remote AT job via SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive strings "atsvc" and "JobAdd". This combination indicates an attempt to use the AT service to add a scheduled task remotely, which can be a method for persistence or execution by attackers.
This rule detects attempts to access the command-line interface (CLI) of a network device via Telnet, specifically looking for the 'enable' and 'configure terminal' commands. This indicates an administrative attempt to configure or manage a network device.
This rule detects attempts to establish a TCP connection to port 902 on the home network, which is commonly used for VMware ESXi management. The rule specifically looks for SYN packets (flags:S) and triggers if there are at least 3 such connection attempts from the same source within a 60-second window. This could indicate an attempt to access or scan the ESXi management interface.
This rule detects the string "xdotool" within an SSH session (port 22) traffic flowing from the client to the server. xdotool is a command-line tool that simulates keyboard input and mouse activity, often used for automated input injection. Detection of this string suggests an attempt to automate actions within an SSH session, which could be indicative of malicious activity such as automated command execution or data exfiltration.
This rule detects potential mass email collection activity over IMAP (port 143). It triggers an alert if a client makes 20 or more 'FETCH BODY[]' requests within a 60-second window to an IMAP server. This behavior is indicative of an attacker or malicious script attempting to download a large number of email bodies, potentially for data exfiltration or analysis.
This rule detects an attempt at RDP lateral movement by identifying multiple RDP connection attempts to a host within a short timeframe. It specifically looks for the RDP connection initiation sequence (hexadecimal content '|03 00 00|') on port 3389 (RDP default port) and triggers an alert if 5 such attempts are observed from the same source within 60 seconds. This behavior is indicative of an attacker trying to move laterally within a network using RDP.
This rule detects potential data exfiltration of USB drive contents over SSH using SCP. It triggers when TCP traffic on port 22 (SSH) from the home network to the home network contains the string "/dev/sd" (case-insensitive) and the data size is greater than 65000 bytes. This combination suggests that a file from a Linux-like USB device (often mounted as /dev/sdX) is being transferred out via SCP.
This rule detects the execution of a system shutdown command ('shutdown -h now') over an SSH connection. It specifically looks for this string within TCP traffic directed to port 22 (SSH) on the home network, indicating a remote shutdown initiated via SSH.
This rule detects attempts to initiate a remote system shutdown via the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic directed to port 445 (SMB) on the home network. This activity is often associated with malicious behavior, such as ransomware or destructive attacks, aiming to disrupt systems.
This rule detects RDP login attempts from an external network to the internal network. It specifically looks for the RDP protocol header (0x03 0x00) on TCP port 3389. A threshold of 5 attempts within 60 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to access SNMP (Simple Network Management Protocol) services on the home network using the default community string 'public'. It specifically looks for the string 'public' within TCP traffic destined for port 161 (the standard SNMP port). A threshold of 5 attempts within 30 seconds from the same source IP will trigger an alert, indicating potential brute-force or reconnaissance activity against SNMP devices.
This rule detects attempts to manipulate stored records within an MSSQL database. It specifically looks for TCP traffic directed to port 1433 (the default MSSQL port) containing the keywords "UPDATE" and "SET" (case-insensitive) in the flow to the server. A threshold of 50 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating potential bulk data modification.
This rule detects SSH connections to the internal network ($HOME_NET) on port 22. It specifically looks for the 'SSH-2.0' content in the TCP flow to the server. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds. The rule's message suggests it's intended to identify third-party SSH access potentially using a vendor key, implying an attempt to detect unauthorized or unusual SSH activity.
This rule detects attempts to manipulate database data on a remote MySQL server (port 3306) by identifying 'UPDATE' and 'SET' SQL commands within TCP traffic. It uses a threshold to alert on a high frequency of these commands from a single source, indicating potential malicious activity like data modification or integrity compromise.
This rule detects a Deauthentication (Deauth) attack pattern, specifically targeting forced Wi-Fi reconnections. It triggers an alert when a high volume (50 or more) of TCP SYN packets are observed from a single source IP address within a 5-second window directed towards the home network. This pattern is indicative of an attacker attempting to flood a Wi-Fi network with deauthentication frames, forcing legitimate clients to disconnect and then reconnect, which can be exploited for various malicious purposes like capturing handshakes or facilitating man-in-the-middle attacks.
This rule detects potential command and control (C2) activity where an internal HTTP proxy port (8080) is used as a relay. Specifically, it looks for HTTP CONNECT requests, which are commonly used for tunneling through proxies, directed to port 8080 within the home network. A threshold of 10 such requests within 60 seconds from a single source IP triggers the alert, indicating suspicious proxy usage for C2 communication.
This rule detects the use of SFTP (Secure File Transfer Protocol) as a covert command and control (C2) data channel. It specifically looks for TCP traffic on port 22 (SFTP's default port) with a specific content pattern ('|00 00 00|') within the first 4 bytes of the payload, a payload size between 100 and 500 bytes, and a high frequency (20 times in 60 seconds) from a single source IP address. This pattern and frequency could indicate an attempt to exfiltrate data or maintain C2 communication disguised as legitimate SFTP traffic.
This rule detects large data transfers (over 65KB) to a remote host via SSH SCP (port 22) within the home network. It uses a thresholding mechanism to alert if 30 such transfers occur within a 60-second window from the same source.
This rule detects the string "zip -e" within TCP traffic on port 22 (SSH). This string is commonly used to create password-protected zip archives, and its presence in an SSH session could indicate an attempt to prepare data for exfiltration, especially if combined with SSH's secure tunneling capabilities. The rule specifically looks for traffic flowing from the client to the server.
This rule detects a high volume of TCP SYN packets from an external IP address to the internal network, indicative of an attempted remote service access or port scan. Specifically, it triggers if 5 or more TCP SYN packets are observed from the same source IP within a 30-second window, targeting any port on the home network.
This rule detects attempts to query the domain password policy over SMB by looking for the 'NetUserModalsGet' content within TCP traffic on port 445. This activity is often associated with reconnaissance or discovery phases by attackers to understand password complexity requirements.
Page 30 of 42